Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.7
CVE-2023-46836: Xen patches for branch and return attacks unsafe during interrupts
CVE-2023-46836 · published 2 years ago
Summary
The recent fixes in Xen that address two speculative execution attacks do not work correctly when hardware interrupts are enabled. This creates a timing gap that could allow a malicious virtual machine to circumvent the protection and carry out an attack. Apply the latest Xen update that ensures the mitigations are interrupt‑safe, or disable the vulnerable features until a proper fix is released.
What to do
- Update debian xen to version 4.17.2+76-ge1f9cb16e2-1~deb12u1.
- Update debian xen to version 4.17.2+76-ge1f9cb16e2-1.
- Update xen to version 4.15.5-r3.
- Update xen to version 4.16.5-r4.
- Update xen to version 4.17.2-r4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | xen |
< 4.17.2+76-ge1f9cb16e2-1~deb12u1 Fix: upgrade to 4.17.2+76-ge1f9cb16e2-1~deb12u1
|
| Debian:13 | debian | xen |
< 4.17.2+76-ge1f9cb16e2-1 Fix: upgrade to 4.17.2+76-ge1f9cb16e2-1
|
| Debian:14 | debian | xen |
< 4.17.2+76-ge1f9cb16e2-1 Fix: upgrade to 4.17.2+76-ge1f9cb16e2-1
|
| Alpine:v3.15 | – | xen |
< 4.15.5-r3 Fix: upgrade to 4.15.5-r3
|
| Alpine:v3.16 | – | xen |
< 4.16.5-r4 Fix: upgrade to 4.16.5-r4
|
| Alpine:v3.18 | – | xen |
< 4.17.2-r4 Fix: upgrade to 4.17.2-r4
|
| – | xen | xen |
All versions
cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | xen | All versions |
Original advisory text
The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled....
The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations are not active together by default. Therefore, there is a race condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack against Xen.
References
- https://security-tracker.debian.org/tracker/CVE-2023-46836 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2023-46836 Vendor Advisory
- https://ubuntu.com/security/CVE-2023-46836 Third Party Advisory
- https://xenbits.xen.org/xsa/advisory-446.html Third Party Advisory
- http://xenbits.xen.org/xsa/advisory-446.html
- https://xenbits.xenproject.org/xsa/advisory-446.html Patch Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-46836 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
4.7
Medium
Timeline
Published5 Jan 2024
Updated4 Nov 2026
First seen15 Sep 2026
Sources
DEBIAN-CVE-2023-46836 · OSV
ALPINE-CVE-2023-46836 · OSV
CVE-2023-46836 · NVD
UBUNTU-CVE-2023-46836 · OSV
Track software like this
Free during beta