CVE-2023-46836

The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations are not active together by default. Therefore, there is a race condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack against Xen.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://xenbits.xenproject.org/xsa/advisory-446.html	Patch Vendor Advisory
https://xenbits.xenproject.org/xsa/advisory-446.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:29

Type	Values Removed	Values Added
References	~~() https://xenbits.xenproject.org/xsa/advisory-446.html - Patch, Vendor Advisory~~	() https://xenbits.xenproject.org/xsa/advisory-446.html - Patch, Vendor Advisory

05 Jan 2024, 18:23

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-05 17:15

Updated : 2025-06-03 15:15

NVD link : CVE-2023-46836

Mitre link : CVE-2023-46836

CVE.ORG link : CVE-2023-46836

JSON object : View

Products Affected

xen

xen

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-46836", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.0}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "published": "2024-01-05T17:15:11.197", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-446.html", "tags": ["Patch", "Vendor Advisory"], "source": "security@xen.org"}, {"url": "https://xenbits.xenproject.org/xsa/advisory-446.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative\nReturn Stack Overflow) are not IRQ-safe. It was believed that the\nmitigations always operated in contexts with IRQs disabled.\n\nHowever, the original XSA-254 fix for Meltdown (XPTI) deliberately left\ninterrupts enabled on two entry paths; one unconditionally, and one\nconditionally on whether XPTI was active.\n\nAs BTC/SRSO and Meltdown affect different CPU vendors, the mitigations\nare not active together by default. Therefore, there is a race\ncondition whereby a malicious PV guest can bypass BTC/SRSO protections\nand launch a BTC/SRSO attack against Xen.\n"}, {"lang": "es", "value": "Las correcciones para XSA-422 (Branch Type Confusion) y XSA-434 (Speculative Return Stack Overflow) no son seguras para IRQ. Se cre\u00eda que las mitigaciones siempre operaban en contextos con las IRQ deshabilitadas. Sin embargo, la soluci\u00f3n XSA-254 original para Meltdown (XPTI) deliberadamente dej\u00f3 habilitadas las interrupciones en dos rutas de entrada; uno incondicionalmente y otro condicionalmente sobre si XPTI estaba activo. Como BTC/SRSO y Meltdown afectan a diferentes proveedores de CPU, las mitigaciones no est\u00e1n activas juntas de forma predeterminada. Por lo tanto, existe una condici\u00f3n de ejecuci\u00f3n mediante la cual un invitado PV malicioso puede eludir las protecciones BTC/SRSO y lanzar un ataque BTC/SRSO contra Xen."}], "lastModified": "2025-06-03T15:15:42.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2B9CCC2-BAC5-4A65-B8D4-4B71EBBA0C2F"}], "operator": "OR"}]}], "sourceIdentifier": "security@xen.org"}