CVE-2023-46839 pci: phantom functions assigned to incorrect contexts

Medium 5.3 Published 20 Mar 2024 Updated 4 Nov 2025

Attackers can exploit phantom function misconfiguration to access resources in a different domain, leading to privilege escalation or data leakage.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-46839?

CVE-2023-46839 is a medium-severity missing authorization vulnerability in Fedoraproject Fedora, published on 20 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests.

Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.

Which versions are affected by CVE-2023-46839?

It affects 2 products.

Linux distribution packages (25)

`xen` SUSE:Enterprise Storage 7.1	All versions	`4.14.6_10-150300.3.63.1`
`xen` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	All versions	`4.12.4_44-150100.3.101.1`
`xen` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`4.13.5_10-150200.3.86.1`
`xen` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	All versions	`4.14.6_10-150300.3.63.1`
`xen` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	All versions	`4.16.5_12-150400.4.46.1`
`xen` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	All versions	`4.16.5_12-150400.4.46.1`
`xen` SUSE:Linux Enterprise Micro 5.1	All versions	`4.14.6_10-150300.3.63.1`
`xen` SUSE:Linux Enterprise Micro 5.2	All versions	`4.14.6_10-150300.3.63.1`
`xen` SUSE:Linux Enterprise Micro 5.3	All versions	`4.16.5_12-150400.4.46.1`
`xen` SUSE:Linux Enterprise Micro 5.4	All versions	`4.16.5_12-150400.4.46.1`
`xen` SUSE:Linux Enterprise Server 12 SP5	All versions	`4.12.4_44-3.103.1`
`xen` SUSE:Linux Enterprise Server 15 SP1-LTSS	All versions	`4.12.4_44-150100.3.101.1`
`xen` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`4.13.5_10-150200.3.86.1`
`xen` SUSE:Linux Enterprise Server 15 SP3-LTSS	All versions	`4.14.6_10-150300.3.63.1`
`xen` SUSE:Linux Enterprise Server 15 SP4-LTSS	All versions	`4.16.5_12-150400.4.46.1`
`xen` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`4.12.4_44-3.103.1`
`xen` SUSE:Linux Enterprise Server for SAP Applications 15 SP1	All versions	`4.12.4_44-150100.3.101.1`
`xen` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`4.13.5_10-150200.3.86.1`
`xen` SUSE:Linux Enterprise Server for SAP Applications 15 SP3	All versions	`4.14.6_10-150300.3.63.1`
`xen` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	All versions	`4.16.5_12-150400.4.46.1`
`xen` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`4.12.4_44-3.103.1`
`xen` SUSE:Manager Proxy 4.3	All versions	`4.16.5_12-150400.4.46.1`
`xen` SUSE:Manager Server 4.3	All versions	`4.16.5_12-150400.4.46.1`
`xen` openSUSE:Leap Micro 5.3	All versions	`4.16.5_12-150400.4.46.1`
`xen` openSUSE:Leap Micro 5.4	All versions	`4.16.5_12-150400.4.46.1`

Products include Fedoraproject Fedora, Xen Xen.

How do I fix CVE-2023-46839?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-46839 being exploited?

There is no known exploitation of CVE-2023-46839 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALPINE-CVE-2023-46839, DEBIAN-CVE-2023-46839, GHSA-8f65-fxmq-vvpx, SUSE-SU-2024:0264-1, SUSE-SU-2024:0265-1, SUSE-SU-2024:0268-1 and 3 more.