CVE-2023-34328 x86/AMD: Debug Mask handling

Medium 5.5 Published 5 Jan 2024 Updated 4 Nov 2025

A malicious PV guest can lock up the CPU by placing a breakpoint over the live GDT, causing a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-34328?

CVE-2023-34328 is a medium-severity denial of service vulnerability in Xen Xen, published on 5 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]

AMD CPUs since ~2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions.

Unfortunately there are errors in Xen's handling of the guest state, leading to denials of service.

1) CVE-2023-34327 - An HVM vCPU can end up operating in the context of a previous vCPUs debug mask state.

2) CVE-2023-34328 - A PV vCPU can place a breakpoint over the live GDT. This allows the PV vCPU to exploit XSA-156 / CVE-2015-8104 and lock up the CPU entirely.

Which versions are affected by CVE-2023-34328?

It affects 1 product.

Products include Xen Xen.

How do I fix CVE-2023-34328?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-34328 being exploited?

There is no known exploitation of CVE-2023-34328 in the wild and no public exploit code.

All Xen Xen vulnerabilities

Sources

Also known as ALPINE-CVE-2023-34328, DEBIAN-CVE-2023-34328, GHSA-fm4g-p248-j5wj, UBUNTU-CVE-2023-34328.