Vulnerability Details : CVE-2023-34324
Closing of an event channel in the Linux kernel can result in a deadlock.
This happens when the close is being performed in parallel to an unrelated
Xen console action and the handling of a Xen console interrupt in an
unprivileged guest.
The closing of an event channel is e.g. triggered by removal of a
paravirtual device on the other side. As this action will cause console
messages to be issued on the other side quite often, the chance of
triggering the deadlock is not neglectable.
Note that 32-bit Arm-guests are not affected, as the 32-bit Linux kernel
on Arm doesn't use queued-RW-locks, which are required to trigger the
issue (on Arm32 a waiting writer doesn't block further readers to get
the lock).
Products affected by CVE-2023-34324
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-34324
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 40 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-34324
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.9
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
1.2
|
3.6
|
NIST | 2024-01-11 |
CWE ids for CVE-2023-34324
-
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-34324
-
https://xenbits.xenproject.org/xsa/advisory-441.html
XSA-441 - Xen Security AdvisoriesPatch;Vendor Advisory
-
https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html
[SECURITY] [DLA 3711-1] linux-5.10 security update
-
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
[SECURITY] [DLA 3710-1] linux security update
Jump to