Skip to content
OpenAdvisories
Medium · 5.3 CVE-2023-3153 EUVD-2023-43837GHSA-qq9r-36hc-f769

Service monitor mac flow is not rate limited

Published Oct 4, 2023 · Updated Sep 19, 2024 · Assigned by redhat

Vendor: Fedora Vendor: Red Hat Product: Fast Datapath for RHEL 7 Product: Fast Datapath for RHEL 8 Product: Fast Datapath for RHEL 9 Product: Fedora Product: Red Hat OpenShift Container Platform 4 Product: Red Hat OpenStack Platform 13 (Queens) Package: ovn Package: ovn Ecosystem: Debian Ecosystem: Ubuntu

Description

A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.

Affected products

VendorProductAffectedFixed
— ovn — 22.12.1
Red Hat Fast Datapath for RHEL 7 — —
Red Hat Fast Datapath for RHEL 8 — —
Red Hat Fast Datapath for RHEL 9 — —
Red Hat Red Hat OpenShift Container Platform 4 — —
Red Hat Red Hat OpenStack Platform 13 (Queens) — —
Fedora Fedora — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 ovn 23.09.0-1 —
Debian 12 ovn 23.03.1-1~deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS ovn 22.03.3-0ubuntu0.22.04.1 —
Ubuntu 20.04 LTS ovn No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Openshift Ironic 4 openstack-ironic +5 1:21.5.0-0.20231002130534.0df5961.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 openstack-ironic-inspector +4 11.5.0-0.20230706175125.193aa0d.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-automaton +1 3.1.0-0.20230608140652.a4f7631.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-cinderclient +1 9.3.0-0.20230608143053.f7a612e.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-cliff +2 4.3.0-0.20230608150702.72e81d7.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-debtcollector +1 2.5.0-0.20230308172820.a6b46c5.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-decorator +1 4.4.2-6.0.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-dracclient +1 8.0.0-0.20230308200614.9c7499c.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-fixtures +1 4.0.1-1.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-futurist +1 2.4.1-0.20230308173923.159d752.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-glanceclient +1 1:4.3.0-0.20230608143056.52fb6b2.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-hardware +2 0.30.0-0.20230308190813.f6ff0ed.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-ironic-lib +1 5.4.1-0.20230706172632.25d8671.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-ironic-prometheus-exporter +1 4.1.1-0.20230614150617.7b35627.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-keystoneauth1 +1 5.2.0-0.20230608152518.2e40bbf.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-keystoneclient +2 1:5.1.0-0.20230608141554.4763cd8.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-keystonemiddleware +1 10.3.0-0.20230608151410.92cdf8a.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-openstacksdk +2 1.2.0-0.20230608155226.b7ff031.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-os-service-types +1 1.7.0-0.20230308170555.0b2f473.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-os-traits +2 3.0.0-0.20230608152745.cff125c.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-osc-lib +2 2.8.0-0.20230608151456.db9cdc9.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-cache +3 3.4.0-0.20230608153448.a720016.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-concurrency +3 5.1.1-0.20230706190204.0af5942.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-config +1 2:9.1.1-0.20230608145954.515daab.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-context +2 5.1.1-0.20230608143931.7696282.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-db +3 12.3.1-0.20230608142355.b689b63.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-i18n +2 6.0.0-0.20230608140652.03605c2.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-log +3 5.2.0-0.20230608150750.16a8a42.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-messaging +2 14.3.1-0.20230608152013.0602d1a.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-middleware +3 5.1.1-0.20230608145931.7725ac9.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-policy +3 4.2.0-0.20230608153320.93129eb.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-rootwrap +2 7.0.1-0.20230608144658.b72372b.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-serialization +2 5.1.1-0.20230608144505.b4be3a4.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-service +2 3.1.1-0.20230608145222.b3ba591.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-upgradecheck +1 2.1.1-0.20230608143829.eeedfc9.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-utils +1 6.1.0-0.20230608142355.d49d594.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-versionedobjects +1 3.1.0-0.20230608141554.b4ea834.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-osprofiler 3.4.3-0.20230308173821.3286301.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-pbr 5.11.1-0.1.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-proliantutils 2.14.1-0.20230608154738.3de2844.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-pycadf +1 3.1.1-0.20230308171749.4179996.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-requestsexceptions 1.4.0-0.20230308170555.d7ac0ff.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-scciclient 0.12.3-0.20230308201513.0940a71.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-stevedore 5.1.0-0.20230608154210.2d99ccc.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-sushy 4.5.0-0.20230719180619.146ed33.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-sushy-oem-idrac 5.0.0-0.20230308202122.da9a0e4.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-swiftclient 4.3.0-0.20230608151934.236c277.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-tenacity 6.3.1-1.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-tooz 4.1.0-0.20230608154038.d5bf20c.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-wrapt +1 1.14.1-1.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python3-ironic-python-agent +2 9.5.0-0.20230728140546.fce0b8c.el9 RHSA-2023:5009
Red Hat OpenShift 4 afterburn +2 5.4.3-1.rhaos4.14.el9 RHSA-2023:5009
Red Hat OpenShift 4 bpftool 7.0.0-284.36.1.el9_2 RHSA-2023:5009
Red Hat OpenShift 4 buildah +1 1:1.29.1-10.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 butane +1 0.19.0-1.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 catch +1 3.3.2-1.el9 RHSA-2023:5009
Red Hat OpenShift 4 conmon 3:2.1.7-3.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 container-selinux 3:2.221.0-1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 containernetworking-plugins 1.0.1-11.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 containers-common 2:1-51.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 coreos-installer +2 0.17.0-1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 cri-o 1.27.1-8.1.rhaos4.14.git3fecb83.el8 RHSA-2023:5009
Red Hat OpenShift 4 cri-tools 1.27.0-2.1.el8 RHSA-2023:5009
Red Hat OpenShift 4 crun 1.9.2-1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 crun-wasm 0.0-3.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 fmt +1 9.1.0-1.el9 RHSA-2023:5009
Red Hat OpenShift 4 gmock +3 1.13.0-1.el9 RHSA-2023:5009
Red Hat OpenShift 4 google-benchmark +2 1.8.2-1.el9 RHSA-2023:5009
Red Hat OpenShift 4 haproxy +1 2.6.13-1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 ignition +1 2.16.2-1.1.rhaos4.14.el9 RHSA-2023:5009
Red Hat OpenShift 4 kata-containers 3.1.3-4.rhaos4.14.el9 RHSA-2023:5009
Red Hat OpenShift 4 kernel-rt +21 5.14.0-284.36.1.rt14.321.el9_2 RHSA-2023:5009
Red Hat OpenShift 4 nmstate +4 2.2.12-1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 openshift +1 4.14.0-202310210404.p0.gf67aeb3.assembly.stream.el8 RHSA-2023:5009
Red Hat OpenShift 4 openshift-ansible +1 4.14.0-202310062327.p0.gf781421.assembly.stream.el8 RHSA-2023:5009
Red Hat OpenShift 4 openshift-clients +1 4.14.0-202310191146.p0.g0c63f9d.assembly.stream.el8 RHSA-2023:5009
Red Hat OpenShift 4 openshift-kuryr +4 4.14.0-202309272140.p0.g8926a29.assembly.stream.el8 RHSA-2023:5009
Red Hat OpenShift 4 openshift-prometheus-promu +1 0.15.0-15.1.gitd5383c5.el8 RHSA-2023:5009
Red Hat OpenShift 4 openshift4-aws-iso 4.14.0-202309272140.p0.gd2acdd5.assembly.stream.el8 RHSA-2023:5009
Red Hat OpenShift 4 ovn22.12 +3 22.12.1-18.el8fdp RHSA-2023:6274
Red Hat OpenShift 4 ovn23.09 +3 23.09.0-37.el9fdp RHSA-2023:5009
Red Hat OpenShift 4 perf +60 5.14.0-284.36.1.el9_2 RHSA-2023:5009
Red Hat OpenShift 4 podman +6 3:4.4.1-10.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 runc 4:1.1.9-2.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 skopeo +1 2:1.11.2-10.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 spdlog +1 1.12.0-1.rhaos4.14.el9 RHSA-2023:5009
Red Hat OpenShift 4 toolbox 0.1.2-1.rhaos4.14.el9 RHSA-2023:5009
Red Hat OpenShift 4 wasmedge +2 0.12.1-2.rhaos4.14.el9 RHSA-2023:5009

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 openvswitch 3.1.7-150600.33.9.1 SUSE-SU-2026:0280-1
SLES 15 SP5 openvswitch3 3.1.0-150500.3.6.2 SUSE-SU-2026:0290-1, SUSE-SU-2023:3710-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 openvswitch 3.1.7-150600.33.9.1 SUSE-SU-2026:0280-1
SLES for SAP 15 SP5 openvswitch3 3.1.7-150500.3.25.1 SUSE-SU-2026:0290-1
SLE Micro 5.5 openvswitch3 3.1.7-150500.3.25.1 SUSE-SU-2026:0290-1
SLE HPC 15 SP5 openvswitch3 3.1.7-150500.3.25.1 SUSE-SU-2026:0290-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed openvswitch 3.1.0-15.1 openSUSE-SU-2024:13206-1
openSUSE Leap 15.6 openvswitch 3.1.7-150600.33.9.1 SUSE-SU-2026:0280-1
openSUSE Leap 15.6 openvswitch3 3.1.7-150500.3.25.1 SUSE-SU-2026:0290-1
openSUSE Leap 15.5 openvswitch3 3.1.0-150500.3.6.2 SUSE-SU-2023:3710-1

Advisories 7

References