CVE-2023-46836 (GCVE-0-2023-46836)
Vulnerability from cvelistv5 – Published: 2024-01-05 16:34 – Updated: 2025-11-04 19:25
VLAI?
Title
x86: BTC/SRSO fixes not fully effective
Summary
The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative
Return Stack Overflow) are not IRQ-safe. It was believed that the
mitigations always operated in contexts with IRQs disabled.
However, the original XSA-254 fix for Meltdown (XPTI) deliberately left
interrupts enabled on two entry paths; one unconditionally, and one
conditionally on whether XPTI was active.
As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations
are not active together by default. Therefore, there is a race
condition whereby a malicious PV guest can bypass BTC/SRSO protections
and launch a BTC/SRSO attack against Xen.
Severity ?
4.7 (Medium)
Assigner
References
Credits
This issue was discovered by Andrew Cooper of XenServer.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T19:25:42.692Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://xenbits.xenproject.org/xsa/advisory-446.html"
},
{
"url": "http://xenbits.xen.org/xsa/advisory-446.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-46836",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-08T20:16:12.540203Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T14:40:56.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-446"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All versions of Xen are vulnerable.\n\nXen is only vulnerable in default configurations on AMD and Hygon CPUs.\n\nXen is not believed to be vulnerable in default configurations on CPUs\nfrom other hardware vendors.\n\nOnly PV guests can leverage the vulnerability.\n"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Andrew Cooper of XenServer.\n"
}
],
"datePublic": "2023-11-14T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative\nReturn Stack Overflow) are not IRQ-safe. It was believed that the\nmitigations always operated in contexts with IRQs disabled.\n\nHowever, the original XSA-254 fix for Meltdown (XPTI) deliberately left\ninterrupts enabled on two entry paths; one unconditionally, and one\nconditionally on whether XPTI was active.\n\nAs BTC/SRSO and Meltdown affect different CPU vendors, the mitigations\nare not active together by default. Therefore, there is a race\ncondition whereby a malicious PV guest can bypass BTC/SRSO protections\nand launch a BTC/SRSO attack against Xen.\n"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker in a PV guest might be able to infer the contents of memory\nbelonging to other guests.\n"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-05T16:34:59.036Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-446.html"
}
],
"title": "x86: BTC/SRSO fixes not fully effective",
"workarounds": [
{
"lang": "en",
"value": "Running only HVM or PVH VMs will avoid the vulnerability.\n"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2023-46836",
"datePublished": "2024-01-05T16:34:59.036Z",
"dateReserved": "2023-10-27T07:55:35.332Z",
"dateUpdated": "2025-11-04T19:25:42.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-446.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://xenbits.xen.org/xsa/advisory-446.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T19:25:42.692Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-46836\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-08T20:16:12.540203Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-08T20:16:14.257Z\"}}], \"cna\": {\"title\": \"x86: BTC/SRSO fixes not fully effective\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This issue was discovered by Andrew Cooper of XenServer.\\n\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"An attacker in a PV guest might be able to infer the contents of memory\\nbelonging to other guests.\\n\"}]}], \"affected\": [{\"vendor\": \"Xen\", \"product\": \"Xen\", \"versions\": [{\"status\": \"unknown\", \"version\": \"consult Xen advisory XSA-446\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2023-11-14T12:00:00.000Z\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-446.html\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Running only HVM or PVH VMs will avoid the vulnerability.\\n\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative\\nReturn Stack Overflow) are not IRQ-safe. It was believed that the\\nmitigations always operated in contexts with IRQs disabled.\\n\\nHowever, the original XSA-254 fix for Meltdown (XPTI) deliberately left\\ninterrupts enabled on two entry paths; one unconditionally, and one\\nconditionally on whether XPTI was active.\\n\\nAs BTC/SRSO and Meltdown affect different CPU vendors, the mitigations\\nare not active together by default. Therefore, there is a race\\ncondition whereby a malicious PV guest can bypass BTC/SRSO protections\\nand launch a BTC/SRSO attack against Xen.\\n\"}], \"configurations\": [{\"lang\": \"en\", \"value\": \"All versions of Xen are vulnerable.\\n\\nXen is only vulnerable in default configurations on AMD and Hygon CPUs.\\n\\nXen is not believed to be vulnerable in default configurations on CPUs\\nfrom other hardware vendors.\\n\\nOnly PV guests can leverage the vulnerability.\\n\"}], \"providerMetadata\": {\"orgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"shortName\": \"XEN\", \"dateUpdated\": \"2024-01-05T16:34:59.036Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-46836\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-04T19:25:42.692Z\", \"dateReserved\": \"2023-10-27T07:55:35.332Z\", \"assignerOrgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"datePublished\": \"2024-01-05T16:34:59.036Z\", \"assignerShortName\": \"XEN\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…