CVE-2023-34327
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
05/01/2024
Last modified:
03/06/2025
Description
<br />
[This CNA information record relates to multiple CVEs; the<br />
text explains which aspects/vulnerabilities correspond to which CVE.]<br />
<br />
AMD CPUs since ~2014 have extensions to normal x86 debugging functionality.<br />
Xen supports guests using these extensions.<br />
<br />
Unfortunately there are errors in Xen&#39;s handling of the guest state, leading<br />
to denials of service.<br />
<br />
1) CVE-2023-34327 - An HVM vCPU can end up operating in the context of<br />
a previous vCPUs debug mask state.<br />
<br />
2) CVE-2023-34328 - A PV vCPU can place a breakpoint over the live GDT.<br />
This allows the PV vCPU to exploit XSA-156 / CVE-2015-8104 and lock<br />
up the CPU entirely.<br />
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:* | 4.5.0 (including) |
To consult the complete list of CPE names with products and versions, see this page