CVE-2023-46842
published 2024-05-16CVE-2023-46842: Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass…
PriorityP434medium6.5CVSS 3.1
AVLACLPRLUINSCCNINAH
EPSS
8.53%
94.4th percentile
Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and
other modes. This in particular means that they may set registers used
to pass 32-bit-mode hypercall arguments to values outside of the range
32-bit code would be able to set them to.
When processing of hypercalls takes a considerable amount of time,
the hypervisor may choose to invoke a hypercall continuation. Doing so
involves putting (perhaps updated) hypercall arguments in respective
registers. For guests not running in 64-bit mode this further involves
a certain amount of translation of the values.
Unfortunately internal sanity checking of these translated values
assumes high halves of registers to always be clear when invoking a
hypercall. When this is found not to be the case, it triggers a
consistency check in the hypervisor and causes a crash.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.17.5+23-ga4e5191dc0-1 (bookworm) | xen 4.17.5+23-ga4e5191dc0-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| xen | xen | >= 0 < 4.16.6-r0 | 4.16.6-r0 |
| xen | xen | >= 0 < 4.16.6-r0 | 4.16.6-r0 |
| xen | xen | >= 0 < 4.17.4-r0 | 4.17.4-r0 |
| xen | xen | >= 0 < 4.18.2-r0 | 4.18.2-r0 |
| xen | xen | >= 0 < 4.18.2-r0 | 4.18.2-r0 |
| xen | xen | >= 0 < 4.18.2-r0 | 4.18.2-r0 |
| xen | xen | >= 0 < 4.18.2-r0 | 4.18.2-r0 |
| xen | xen | >= 0 < 4.18.2-r0 | 4.18.2-r0 |
| xen | xen | >= 0 < 4.17.5+23-ga4e5191dc0-1 | 4.17.5+23-ga4e5191dc0-1 |
| xen | xen | >= 0 < 4.19.1-1 | 4.19.1-1 |
| xen | xen | >= 0 < 4.19.1-1 | 4.19.1-1 |
| xen | xen | >= 3.2.0 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hcr5-hp8w-36q9: Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and
other modes
ghsa_unreviewed·2024-05-16
CVE-2023-46842 [MEDIUM] CWE-843 GHSA-hcr5-hp8w-36q9: Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and
other modes
Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and
other modes. This in particular means that they may set registers used
to pass 32-bit-mode hypercall arguments to values outside of the range
32-bit code would be able to set them to.
When processing of hypercalls takes a considerable amount of time,
the hypervisor may choose to invoke a hypercall continuation. Doing so
involves putting (perhaps updated) hypercall arguments in respective
registers. For guests not running in 64-bit mode this further involves
a certain amount of translation of the values.
Unfortunately internal sanity checking of these translated values
assumes high halves of registers to always be clear when invoking a
hypercall. When this is found not to be the case, it triggers a
consistency check
OSV
CVE-2023-46842: Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and
other modes
osv·2024-05-16·CVSS 6.5
CVE-2023-46842 [MEDIUM] CVE-2023-46842: Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and
other modes
Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and
other modes. This in particular means that they may set registers used
to pass 32-bit-mode hypercall arguments to values outside of the range
32-bit code would be able to set them to.
When processing of hypercalls takes a considerable amount of time,
the hypervisor may choose to invoke a hypercall continuation. Doing so
involves putting (perhaps updated) hypercall arguments in respective
registers. For guests not running in 64-bit mode this further involves
a certain amount of translation of the values.
Unfortunately internal sanity checking of these translated values
assumes high halves of registers to always be clear when invoking a
hypercall. When this is found not to be the case, it triggers a
consistency check
OSV
CVE-2023-46842: Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes
osv·2024-05-16·CVSS 6.5
CVE-2023-46842 [MEDIUM] CVE-2023-46842: Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes
Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass 32-bit-mode hypercall arguments to values outside of the range 32-bit code would be able to set them to. When processing of hypercalls takes a considerable amount of time, the hypervisor may choose to invoke a hypercall continuation. Doing so involves putting (perhaps updated) hypercall arguments in respective registers. For guests not running in 64-bit mode this further involves a certain amount of translation of the values. Unfortunately internal sanity checking of these translated values assumes high halves of registers to always be clear when invoking a hypercall. When this is found not to be the case, it triggers a consistency check in
Debian
CVE-2023-46842: xen - Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other m...
vendor_debian·2023·CVSS 6.5
CVE-2023-46842 [MEDIUM] CVE-2023-46842: xen - Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other m...
Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass 32-bit-mode hypercall arguments to values outside of the range 32-bit code would be able to set them to. When processing of hypercalls takes a considerable amount of time, the hypervisor may choose to invoke a hypercall continuation. Doing so involves putting (perhaps updated) hypercall arguments in respective registers. For guests not running in 64-bit mode this further involves a certain amount of translation of the values. Unfortunately internal sanity checking of these translated values assumes high halves of registers to always be clear when invoking a hypercall. When this is found not to be the case, it triggers a consistency check in
No detection rules found.
No public exploits indexed.
https://xenbits.xenproject.org/xsa/advisory-454.htmlhttp://xenbits.xen.org/xsa/advisory-454.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/D5OK6MH75S7YWD34EWW7QIZTS627RIE3/https://lists.fedoraproject.org/archives/list/[email protected]/message/RYAZ7P6YFJ2E3FHKAGIKHWS46KYMMTZH/https://xenbits.xenproject.org/xsa/advisory-454.html
2024-05-16
Published