Log in Start free

Vulnerability · Published Jan 5, 2024 · Assigned by XEN

CVE-2023-34324Possible deadlock in Linux kernel event handling

Medium 4.9

In plain English

A medium-severity uncontrolled resource consumption in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)1.2%top 32.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not affected, as the 32-bit Linux kernel on Arm doesn't use queued-RW-locks, which are required to trigger the issue (on Arm32 a waiting writer doesn't block further readers to get the lock).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.64-1DEBIAN-CVE-2023-34324
Debian:13linux6.5.8-1DEBIAN-CVE-2023-34324
Debian:14linux6.5.8-1DEBIAN-CVE-2023-34324
Ubuntu:22.04:LTSlinux5.15.0-94.104UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux5.15.0-94.104USN-6626-1
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-aws5.15.0-1053.58USN-6626-1
Ubuntu:22.04:LTSlinux-aws5.15.0-1053.58UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-azure5.15.0-1056.64UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-azure5.15.0-1056.64USN-6626-3
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1056.64.1UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1056.64.1USN-6626-3
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-gcp5.15.0-1051.59UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-gcp5.15.0-1051.59USN-6626-1
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-gke5.15.0-1050.55UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-gke5.15.0-1050.55USN-6626-1
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1036.42USN-6626-1
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1036.42UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-hwe-6.56.5.0-17.17~22.04.1USN-6624-1
Ubuntu:22.04:LTSlinux-hwe-6.56.5.0-17.17~22.04.1UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-ibm5.15.0-1046.49UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-ibm5.15.0-1046.49USN-6626-1
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1047.53USN-6628-1
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1047.53UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-kvm5.15.0-1050.55UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-kvm5.15.0-1050.55USN-6626-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-94.104USN-6626-2
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-94.104UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.56.5.0-17.17.1.1.1~22.04.1UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.56.5.0-17.17.1.1.1~22.04.1USN-6624-1
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1044.44USN-6626-1
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1044.44UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-nvidia-6.56.5.0-1014.14UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1022.22UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1009.9UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-oem-6.16.1.0-1025.25USN-6461-1
Ubuntu:22.04:LTSlinux-oem-6.16.1.0-1025.25UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-oem-6.56.5.0-1014.15UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-oem-6.56.5.0-1014.15USN-6624-1
Ubuntu:22.04:LTSlinux-oracle5.15.0-1051.57USN-6626-1
Ubuntu:22.04:LTSlinux-oracle5.15.0-1051.57UBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-raspi5.15.0-1046.49USN-6626-2
Ubuntu:22.04:LTSlinux-raspi5.15.0-1046.49UBUNTU-CVE-2023-34324
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2023-34324
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1027.31UBUNTU-CVE-2023-34324

Affected products (as reported)

VendorProductVersions
Linux Linux see references

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References