vulnerability

Amazon Linux AMI: CVE-2023-34324: Security patch for kernel (ALAS-2023-1883)

Severity
6
CVSS
(AV:N/AC:L/Au:M/C:N/I:N/A:C)
Published
Dec 4, 2023
Added
Apr 11, 2024
Modified
May 21, 2025

Description

Closing of an event channel in the Linux kernel can result in a deadlock.


This happens when the close is being performed in parallel to an unrelated


Xen console action and the handling of a Xen console interrupt in an


unprivileged guest.



The closing of an event channel is e.g. triggered by removal of a


paravirtual device on the other side. As this action will cause console


messages to be issued on the other side quite often, the chance of


triggering the deadlock is not neglectable.



Note that 32-bit Arm-guests are not affected, as the 32-bit Linux kernel


on Arm doesn't use queued-RW-locks, which are required to trigger the


issue (on Arm32 a waiting writer doesn't block further readers to get


the lock).

Solution

amazon-linux-upgrade-kernel
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.