CVE-2023-34324

What it actually does

Closing an event channel in parallel with Xen console actions and interrupt handling in an unprivileged 64-bit Linux guest using queued-RW-locks triggers a deadlock in the kernel event channel code.

Why it matters to the business

Virtual machines running affected Linux kernels on Xen can hang or become unresponsive, causing service outages and requiring manual restarts in cloud or virtualized environments.

How an attack unfolds

An attacker with access to an unprivileged Xen guest triggers removal of a paravirtual device while unrelated console operations occur, forcing the kernel into a deadlock state during event channel close and interrupt handling.

How to fix it

Upgrade the Linux kernel to a version containing commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442 or later; for affected Harbor deployments update to 2.9.4 or 2.10.2.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or a later backport; test by attempting concurrent event channel close and console operations in a Xen guest environment.

Typical attack path

1. Gain access to an unprivileged Xen guest
2. Trigger paravirtual device removal to initiate event channel close
3. Induce concurrent Xen console activity and interrupt handling
4. Cause kernel deadlock on 64-bit systems using queued-RW-locks

How to detect it

Inspect kernel logs and dmesg for deadlock warnings or hung task messages involving event channels or Xen console interrupts on Xen guests.

What your security team should do

• Prioritize kernel upgrades on all Xen-based Linux guests within the next maintenance window
• Monitor for kernel deadlock symptoms in Xen console and dmesg logs
• Review virtualization platform configurations to limit unprivileged guest capabilities where possible