CVE-2023-34322
CVE-2023-34322 is a high-severity vulnerability in Xen with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-273.
Key facts
- Severity: High (CVSS 3.x base score 7.8)
- EPSS exploit prediction: 0% (14th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2023-38403
- Weakness: CWE-273
- Affected product: Xen
- Published:
- Last modified:
Description
For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on the shadow of the guest root page table. In the course of dealing with shortage of memory in the shadow pool associated with a domain, shadows of page tables may be torn down. This tearing down may include the shadow root page table that the CPU in question is presently running on. While a precaution exists to supposedly prevent the tearing down of the underlying live page table, the time window covered by that precaution isn't large enough.
Frequently asked questions
- What is CVE-2023-34322?
- For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on the shadow of the guest root page table. In the course of dealing with shortage of memory in the shadow pool associated with a domain, shadows of page tables may be torn down. This tearing down may include the shadow root page table that the CPU in question is presently running on. While a precaution exists to supposedly prevent the tearing down of the underlying live page table, the time window covered by that precaution isn't large enough.
- How severe is CVE-2023-34322?
- CVE-2023-34322 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2023-34322 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-34322?
- CVE-2023-34322 affects Xen. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-34322?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2023-34322 have an EU (EUVD) identifier?
- Yes. CVE-2023-34322 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-38403.
- When was CVE-2023-34322 published?
- CVE-2023-34322 was published on 2024-01-05 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*
More vulnerabilities in Xen
- CVE-2017-10921 — Critical (CVSS 10.0): The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and…
- CVE-2017-10920 — Critical (CVSS 10.0): The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and GNTMAP_host_map mapping, when followed…
- CVE-2017-10918 — Critical (CVSS 10.0): Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to…
- CVE-2017-10912 — Critical (CVSS 10.0): Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka…
- CVE-2015-8104 — Critical (CVSS 10.0): The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a…
- CVE-2018-12892 — Critical (CVSS 9.9): An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI…
Other CWE-273 vulnerabilities
- CVE-2015-0278 — Critical (CVSS 10.0): libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain…
- CVE-2023-34844 — Critical (CVSS 9.8): Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker container to escape.
- CVE-2021-36372 — Critical (CVSS 9.8): In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and…
- CVE-2020-24361 — Critical (CVSS 9.8): SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknown_trap_exec.
- CVE-2011-3350 — Critical (CVSS 9.8): masqmail 0.2.21 through 0.2.30 improperly calls seteuid() in src/log.c and src/masqmail.c that results in improper…
- CVE-2011-2921 — Critical (CVSS 9.8): ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified…