CVE-2023-34326Operation on a Resource after Expiration or Release in XEN

Severity
7.8HIGHNVD
EPSS
0.1%
top 71.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 5

Description

The caching invalidation guidelines from the AMD-Vi specification (48882—Rev 3.07-PUB—Oct 2022) is incorrect on some hardware, as devices will malfunction (see stale DMA mappings) if some fields of the DTE are updated but the IOMMU TLB is not flushed. Such stale DMA mappings can point to memory ranges not owned by the guest, thus allowing access to unindented memory regions.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

debiandebian/xen< xen 4.17.2+76-ge1f9cb16e2-1~deb12u1 (bookworm)
Alpinexen/xen< 4.15.5-r3+8
Debianxen/xen< 4.17.2+76-ge1f9cb16e2-1~deb12u1+2

🔴Vulnerability Details

3
GHSA
GHSA-mjvw-frxx-6hm5: The caching invalidation guidelines from the AMD-Vi specification (48882—Rev 32024-01-05
OSV
CVE-2023-34326: The caching invalidation guidelines from the AMD-Vi specification (48882—Rev 32024-01-05
OSV
CVE-2023-34326: The caching invalidation guidelines from the AMD-Vi specification (48882—Rev 32024-01-05

📋Vendor Advisories

2
Citrix
Citrix Hypervisor Multiple Security Updates2023-10-10
Debian
CVE-2023-34326: xen - The caching invalidation guidelines from the AMD-Vi specification (48882—Rev 3.0...2023