CVE-2023-46837 arm32: The cache may not be properly cleaned/invalidated (take two)

Low 3.3 Published 5 Jan 2024 Updated 4 Nov 2025

Integer overflow in Xen arm32 cache helpers skips invalidation, potentially allowing guest memory corruption or information disclosure.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-46837?

CVE-2023-46837 is a low-severity vulnerability in Xen Xen, published on 5 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest.

Unfortunately, the arithmetics in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore there is no guarantee when all the writes will reach the memory.

This undefined behavior was meant to be addressed by XSA-437, but the approach was not sufficient.

Weakness: CWE-119

Which versions are affected by CVE-2023-46837?

It affects 1 product.

Products include Xen Xen.

How do I fix CVE-2023-46837?

Apply the vendor's patch.

Is CVE-2023-46837 being exploited?

There is no known exploitation of CVE-2023-46837 in the wild and no public exploit code.

All Xen Xen vulnerabilities

Sources

Also known as ALPINE-CVE-2023-46837, DEBIAN-CVE-2023-46837, GHSA-v75r-qqcp-59c7, UBUNTU-CVE-2023-46837.