CVE-2023-34321

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest.

Unfortunately, the arithmetics in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore there is no guarantee when all the writes will reach the memory.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jan 5, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-343227.8For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itselfCVE-2023-343235.5When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes. It would be possiCVE-2023-343244.9Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an uCVE-2023-343257.8[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimageCVE-2023-343267.8The caching invalidation guidelines from the AMD-Vi specification (48882—Rev 3.07-PUB—Oct 2022) is incorrect on some hardware, as devices wiCVE-2023-343275.5[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs sCVE-2023-343285.5[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs sCVE-2023-343298.0AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful CVE-2023-34335.5The "nickname" field within Savoir-faire Linux's Jami application is susceptible to a failed state when a user inserts special characters inCVE-2023-343308.8AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. CVE-2023-343327.8AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference by a local network. A successfCVE-2023-343337.8AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference via a local network. A success
CVE-2023-34321: Low severity, CVSS 3.3 | Vulnix