CVE-2023-46841 x86: shadow stack vs exceptions from emulation stubs

What is CVE-2023-46841?

CVE-2023-46841 is a medium-severity vulnerability in Fedoraproject Fedora, published on 20 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this are Shadow Stacks (CET-SS). CET-SS is a hardware feature designed to protect against Return Oriented Programming attacks. When enabled, traditional stacks holding both data and return addresses are accompanied by so called "shadow stacks", holding little more than return addresses. Shadow stacks aren't writable by normal instructions, and upon function returns their contents are used to check for possible manipulation of a return address coming from the traditional stack.

In particular certain memory accesses need intercepting by Xen. In various cases the necessary emulation involves kind of replaying of the instruction. Such replaying typically involves filling and then invoking of a stub. Such a replayed instruction may raise an exceptions, which is expected and dealt with accordingly.

Unfortunately the interaction of both of the above wasn't right: Recovery involves removal of a call frame from the (traditional) stack. The counterpart of this operation for the shadow stack was missing.

Which versions are affected by CVE-2023-46841?

It affects 2 products.

Products include Fedoraproject Fedora, Xen Xen.

How do I fix CVE-2023-46841?

Apply the vendor's patch.

Is CVE-2023-46841 being exploited?

There is no known exploitation of CVE-2023-46841 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2023-46841, DEBIAN-CVE-2023-46841, GHSA-mxh6-2xpg-m77w, SUSE-SU-2024:0934-1, SUSE-SU-2024:0935-1, UBUNTU-CVE-2023-46841 and 1 more.