CVE-2023-3153

A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.

This vulnerability is rated as Moderate severity because an attacker on an attached logical network can trigger high CPU utilization on host nodes running ovn-controller, causing a denial of service without compromising system confidentiality or integrity. In Red Hat OpenShift Container Platform and Fast Datapath deployments utilizing OVN, incoming packets directed to the internal service monitor hardware address bypass Control Plane Policing (CoPP) thresholds and are forwarded directly to the pinctrl thread. This traffic flood can exhaust controller processing resources and impair switch management, though the impact remains restricted to service disruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.