CVE-2023-34325
published 2024-01-05CVE-2023-34325: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimage contains parsing…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.29%
20.9th percentile
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
libfsimage contains parsing code for several filesystems, most of them based on
grub-legacy code. libfsimage is used by pygrub to inspect guest disks.
Pygrub runs as the same user as the toolstack (root in a priviledged domain).
At least one issue has been reported to the Xen Security Team that allows an
attacker to trigger a stack buffer overflow in libfsimage. After further
analisys the Xen Security Team is no longer confident in the suitability of
libfsimage when run against guest controlled input with super user priviledges.
In order to not affect current deployments that rely on pygrub patches are
provided in the resolution section of the advisory that allow running pygrub in
deprivileged mode.
CVE-2023-4949 refers to the original issue in the upstream grub
project ("An attacker with local access to a system (either through a
disk or external drive) can present a modified XFS partition to
grub-legacy in such a way to exploit a memory corruption in grub’s XFS
file system implementation.") CVE-2023-34325 refers specifically to
the vulnerabilities in Xen's copy of libfsimage, which is decended
from a very old version of grub.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.17.2+76-ge1f9cb16e2-1~deb12u1 (bookworm) | xen 4.17.2+76-ge1f9cb16e2-1~deb12u1 (bookworm) |
| xen | xen | >= 0 < 4.15.5-r3 | 4.15.5-r3 |
| xen | xen | >= 0 < 4.16.5-r3 | 4.16.5-r3 |
| xen | xen | >= 0 < 4.16.5-r3 | 4.16.5-r3 |
| xen | xen | >= 0 < 4.17.2-r3 | 4.17.2-r3 |
| xen | xen | >= 0 < 4.17.2-r3 | 4.17.2-r3 |
| xen | xen | >= 0 < 4.17.2-r3 | 4.17.2-r3 |
| xen | xen | >= 0 < 4.17.2-r3 | 4.17.2-r3 |
| xen | xen | >= 0 < 4.17.2-r3 | 4.17.2-r3 |
| xen | xen | >= 0 < 4.17.2-r3 | 4.17.2-r3 |
| xen | xen | >= 0 < 4.17.2+76-ge1f9cb16e2-1~deb12u1 | 4.17.2+76-ge1f9cb16e2-1~deb12u1 |
| xen | xen | >= 0 < 4.17.2+55-g0b56bed864-1 | 4.17.2+55-g0b56bed864-1 |
| xen | xen | >= 0 < 4.17.2+55-g0b56bed864-1 | 4.17.2+55-g0b56bed864-1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-34325: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE
osv·2024-01-05·CVSS 7.8
CVE-2023-34325 [HIGH] CVE-2023-34325: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimage contains parsing code for several filesystems, most of them based on grub-legacy code. libfsimage is used by pygrub to inspect guest disks. Pygrub runs as the same user as the toolstack (root in a priviledged domain). At least one issue has been reported to the Xen Security Team that allows an attacker to trigger a stack buffer overflow in libfsimage. After further analisys the Xen Security Team is no longer confident in the suitability of libfsimage when run against guest controlled input with super user priviledges. In order to not affect current deployments that rely on pygrub patches are provided in the resolution section of the advisory that allow
GHSA
GHSA-gwmw-qvr5-88j2: [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE
ghsa_unreviewed·2024-01-05·CVSS 7.8
CVE-2023-34325 [HIGH] CWE-787 GHSA-gwmw-qvr5-88j2: [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
libfsimage contains parsing code for several filesystems, most of them based on
grub-legacy code. libfsimage is used by pygrub to inspect guest disks.
Pygrub runs as the same user as the toolstack (root in a priviledged domain).
At least one issue has been reported to the Xen Security Team that allows an
attacker to trigger a stack buffer overflow in libfsimage. After further
analisys the Xen Security Team is no longer confident in the suitability of
libfsimage when run against guest controlled input with super user priviledges.
In order to not affect current deployments that rely on pygrub patches are
provided in the resolution section of the advisory that a
OSV
CVE-2023-34325: [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE
osv·2024-01-05·CVSS 7.8
CVE-2023-34325 [HIGH] CVE-2023-34325: [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
libfsimage contains parsing code for several filesystems, most of them based on
grub-legacy code. libfsimage is used by pygrub to inspect guest disks.
Pygrub runs as the same user as the toolstack (root in a priviledged domain).
At least one issue has been reported to the Xen Security Team that allows an
attacker to trigger a stack buffer overflow in libfsimage. After further
analisys the Xen Security Team is no longer confident in the suitability of
libfsimage when run against guest controlled input with super user priviledges.
In order to not affect current deployments that rely on pygrub patches are
provided in the resolution section of the advisory that a
Debian
CVE-2023-34325: xen - [This CNA information record relates to multiple CVEs; the text explains which a...
vendor_debian·2023·CVSS 7.8
CVE-2023-34325 [HIGH] CVE-2023-34325: xen - [This CNA information record relates to multiple CVEs; the text explains which a...
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimage contains parsing code for several filesystems, most of them based on grub-legacy code. libfsimage is used by pygrub to inspect guest disks. Pygrub runs as the same user as the toolstack (root in a priviledged domain). At least one issue has been reported to the Xen Security Team that allows an attacker to trigger a stack buffer overflow in libfsimage. After further analisys the Xen Security Team is no longer confident in the suitability of libfsimage when run against guest controlled input with super user priviledges. In order to not affect current deployments that rely on pygrub patches are provided in the resolution section of the advisory that allow
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-01-05
Published