Vulnerability · Published Jan 5, 2024 · Assigned by XEN
CVE-2023-34323xenstored: A transaction conflict can crash C Xenstored
Medium 5.5
In plain English
A medium-severity null pointer dereference in Xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes. It would be possible that accounting is temporarily negative if a node has been removed outside of the transaction. Unfortunately, some versions of C Xenstored are assuming that the quota cannot be negative and are using assert() to confirm it. This will lead to C Xenstored crash when tools are built without -DNDEBUG (this is the default).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | xen | 4.17.2-r3 | ALPINE-CVE-2023-34323 |
| Alpine:v3.21 | xen | 4.17.2-r3 | ALPINE-CVE-2023-34323 |
| Alpine:v3.22 | xen | 4.17.2-r3 | ALPINE-CVE-2023-34323 |
| Alpine:v3.23 | xen | 4.17.2-r3 | ALPINE-CVE-2023-34323 |
| Alpine:v3.24 | xen | 4.17.2-r3 | ALPINE-CVE-2023-34323 |
| Debian:12 | xen | 4.17.2+76-ge1f9cb16e2-1~deb12u1 | DEBIAN-CVE-2023-34323 |
| Debian:13 | xen | 4.17.2+55-g0b56bed864-1 | DEBIAN-CVE-2023-34323 |
| Debian:14 | xen | 4.17.2+55-g0b56bed864-1 | DEBIAN-CVE-2023-34323 |
| Ubuntu:22.04:LTS | xen | no fix listed | UBUNTU-CVE-2023-34323 |
| Ubuntu:24.04:LTS | xen | no fix listed | UBUNTU-CVE-2023-34323 |
| Ubuntu:25.10 | xen | no fix listed | UBUNTU-CVE-2023-34323 |
| Ubuntu:26.04:LTS | xen | no fix listed | UBUNTU-CVE-2023-34323 |
| Ubuntu:26.10 | xen | no fix listed | UBUNTU-CVE-2023-34323 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H