cvelist/2023/46xxx/CVE-2023-46836.json

{
    "data_version": "4.0",
    "data_type": "CVE",
    "data_format": "MITRE",
    "CVE_data_meta": {
        "ID": "CVE-2023-46836",
        "ASSIGNER": "security@xen.org",
        "STATE": "PUBLIC"
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative\nReturn Stack Overflow) are not IRQ-safe.  It was believed that the\nmitigations always operated in contexts with IRQs disabled.\n\nHowever, the original XSA-254 fix for Meltdown (XPTI) deliberately left\ninterrupts enabled on two entry paths; one unconditionally, and one\nconditionally on whether XPTI was active.\n\nAs BTC/SRSO and Meltdown affect different CPU vendors, the mitigations\nare not active together by default.  Therefore, there is a race\ncondition whereby a malicious PV guest can bypass BTC/SRSO protections\nand launch a BTC/SRSO attack against Xen.\n"
            }
        ]
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "n/a"
                    }
                ]
            }
        ]
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "Xen",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Xen",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_value": "not down converted",
                                            "x_cve_json_5_version_data": {
                                                "versions": [
                                                    {
                                                        "status": "unknown",
                                                        "version": "consult Xen advisory XSA-446"
                                                    }
                                                ],
                                                "defaultStatus": "unknown"
                                            }
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "references": {
        "reference_data": [
            {
                "url": "https://xenbits.xenproject.org/xsa/advisory-446.html",
                "refsource": "MISC",
                "name": "https://xenbits.xenproject.org/xsa/advisory-446.html"
            }
        ]
    },
    "configuration": [
        {
            "lang": "en",
            "value": "All versions of Xen are vulnerable.\n\nXen is only vulnerable in default configurations on AMD and Hygon CPUs.\n\nXen is not believed to be vulnerable in default configurations on CPUs\nfrom other hardware vendors.\n\nOnly PV guests can leverage the vulnerability.\n"
        }
    ],
    "work_around": [
        {
            "lang": "en",
            "value": "Running only HVM or PVH VMs will avoid the vulnerability.\n"
        }
    ],
    "credits": [
        {
            "lang": "en",
            "value": "This issue was discovered by Andrew Cooper of XenServer.\n"
        }
    ]
}