CVE-2023-46835 — Out-of-bounds Write in XEN
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 75.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 5
Description
The current setup of the quarantine page tables assumes that the
quarantine domain (dom_io) has been initialized with an address width
of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and hence 4 page table levels.
However dom_io being a PV domain gets the AMD-Vi IOMMU page tables
levels based on the maximum (hot pluggable) RAM address, and hence on
systems with no RAM above the 512GB mark only 3 page-table levels are
configured in the IOMMU.
On systems without RAM above the 512GB boundary
amd_iommu_quara…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6
Affected Packages3 packages
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-c2mm-wq7p-rpm8: The current setup of the quarantine page tables assumes that the
quarantine domain (dom_io) has been initialized with an address width
of DEFAULT_DOMA↗2024-01-05
OSV▶
CVE-2023-46835: The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been initialized with an address width of DEFAULT_DOMA↗2024-01-05
OSV▶
CVE-2023-46835: The current setup of the quarantine page tables assumes that the
quarantine domain (dom_io) has been initialized with an address width
of DEFAULT_DOMA↗2024-01-05
📋Vendor Advisories
1Debian▶
CVE-2023-46835: xen - The current setup of the quarantine page tables assumes that the quarantine doma...↗2023