CVE-2023-34323

When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes. It would be possible that accounting is temporarily negative if a node has been removed outside of the transaction. Unfortunately, some versions of C Xenstored are assuming that the quota cannot be negative and are using assert() to confirm it. This will lead to C Xenstored crash when tools are built without -DNDEBUG (this is the default).

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://xenbits.xenproject.org/xsa/advisory-440.html	Patch Vendor Advisory
https://xenbits.xenproject.org/xsa/advisory-440.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:07

Type	Values Removed	Values Added
References	~~() https://xenbits.xenproject.org/xsa/advisory-440.html - Patch, Vendor Advisory~~	() https://xenbits.xenproject.org/xsa/advisory-440.html - Patch, Vendor Advisory

11 Jan 2024, 17:07

Type	Values Removed	Values Added
First Time		Xen Xen xen
References	~~() https://xenbits.xenproject.org/xsa/advisory-440.html -~~	() https://xenbits.xenproject.org/xsa/advisory-440.html - Patch, Vendor Advisory
CWE		CWE-476
CPE		cpe:2.3:o:xen:xen::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5

05 Jan 2024, 18:23

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-05 17:15

Updated : 2024-11-21 08:07

NVD link : CVE-2023-34323

Mitre link : CVE-2023-34323

CVE.ORG link : CVE-2023-34323

JSON object : View

Products Affected

xen

xen

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2023-34323", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-01-05T17:15:08.493", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-440.html", "tags": ["Patch", "Vendor Advisory"], "source": "security@xen.org"}, {"url": "https://xenbits.xenproject.org/xsa/advisory-440.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "When a transaction is committed, C Xenstored will first check\nthe quota is correct before attempting to commit any nodes. It would\nbe possible that accounting is temporarily negative if a node has\nbeen removed outside of the transaction.\n\nUnfortunately, some versions of C Xenstored are assuming that the\nquota cannot be negative and are using assert() to confirm it. This\nwill lead to C Xenstored crash when tools are built without -DNDEBUG\n(this is the default).\n"}, {"lang": "es", "value": "Cuando se confirma una transacci\u00f3n, C Xenstored primero verificar\u00e1 que la cuota sea correcta antes de intentar confirmar cualquier nodo. Ser\u00eda posible que la contabilidad fuera temporalmente negativa si se hubiera eliminado un nodo fuera de la transacci\u00f3n. Desafortunadamente, algunas versiones de C Xenstored asumen que la cuota no puede ser negativa y utilizan assert() para confirmarlo. Esto provocar\u00e1 un bloqueo de C Xenstored cuando las herramientas se creen sin -DNDEBUG (este es el valor predeterminado). "}], "lastModified": "2024-11-21T08:07:00.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B65D9EE-AB21-4DF4-A578-679B6357308F", "versionEndExcluding": "4.17.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@xen.org"}