CVE-2023-52702

What it actually does

Failure to free the detached old_meter structure in ovs_meter_cmd_set when the new meter attachment does not succeed, resulting in a kernel memory leak.

Why it matters to the business

Repeated meter configuration operations on systems using Open vSwitch can gradually exhaust available memory, leading to degraded network performance, instability, or crashes in virtualized or cloud environments relying on the kernel.

How an attack unfolds

An attacker with sufficient privileges to issue Open vSwitch meter configuration commands triggers repeated detach operations that fail to release memory when new meter attachment fails, accumulating leaked allocations until memory pressure causes denial of service.

How to fix it

Update the Linux kernel to a version containing commit c0f65ee0a3329eb4b94beaef0268633696e2d0c6 or later; rebuild and deploy the fixed kernel across affected hosts.

How to confirm the fix worked

Confirm the presence of the fix by inspecting the ovs_meter_cmd_set function in the kernel source for the corrected free logic after detachment, or verify the running kernel includes the referenced commit.

Typical attack path

1. Obtain access to configure Open vSwitch meters on a target Linux system
2. Issue meter set commands that detach an existing meter
3. Cause the new meter attachment to fail while ensuring the old meter is not freed
4. Repeat the sequence to accumulate unfreed memory allocations
5. Continue until kernel memory exhaustion triggers instability or crashes

How to detect it

Review kernel logs and OVS debug output for repeated meter command failures around detachment operations; monitor system memory statistics for unexplained growth attributable to Open vSwitch meter structures.

What your security team should do

• Apply the kernel update containing commit c0f65ee0a3329eb4b94beaef0268633696e2d0c6 as the highest priority on all systems running Open vSwitch
• Review and restrict privileges required to modify Open vSwitch meter configurations
• Monitor kernel memory usage and OVS-related allocations in production environments until patches are deployed