CVE-2023-34323: xenstored: A transaction conflict can crash C Xenstored

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-05 · updated 2026-06-17
Weakness: CWE-476

Description

When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes. It would be possible that accounting is temporarily negative if a node has been removed outside of the transaction. Unfortunately, some versions of C Xenstored are assuming that the quota cannot be negative and are using assert() to confirm it. This will lead to C Xenstored crash when tools are built without -DNDEBUG (this is the default).

Affected products

xen: before 4.17.0 — fixed in 4.17.0

How to fix

Upgrade to a fixed version: xen 4.17.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-34323 or the next vulnerability affects your stack