Improper Locking Affecting xen package, versions <4.16.4-r3


Severity

Recommended
0.0
medium
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.07% (31st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALPINE316-XEN-5818773
  • published3 Aug 2023
  • disclosed8 Dec 2023

Introduced: 3 Aug 2023

CVE-2023-34320  (opens in a new tab)
CWE-667  (opens in a new tab)

How to fix?

Upgrade Alpine:3.16 xen to version 4.16.4-r3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream xen package and not the xen package as distributed by Alpine. See How to fix? for Alpine:3.16 relevant fixed versions and status.

Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of either a load to device or non-cacheable memory, and either a store exclusive or register read of the Physical Address Register (PAR_EL1) in close proximity.

CVSS Scores

version 3.1