CVE-2023-46836 x86: BTC/SRSO fixes not fully effective
A race condition in Xen hypervisor allows malicious guests to bypass speculative execution mitigations, enabling Branch Type Confusion and Return Stack Overflow attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46836?
CVE-2023-46836 is a medium-severity vulnerability in Xen Xen, published on 5 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled.
However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active.
As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations are not active together by default. Therefore, there is a race condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack against Xen.
Which versions are affected by CVE-2023-46836?
It affects 1 product.
Products include Xen Xen.
How do I fix CVE-2023-46836?
Apply the vendor's patch.
Is CVE-2023-46836 being exploited?
There is no known exploitation of CVE-2023-46836 in the wild and no public exploit code.
Other vulnerabilities in Xen Xen
Sources
Also known as ALPINE-CVE-2023-46836, DEBIAN-CVE-2023-46836, GHSA-4rmw-8gh7-w6g3, UBUNTU-CVE-2023-46836.