PT-2023-7266 · Xen+2 · Xen+2

Roger Pau + 1 · Publicado 2023-11-14 · Atualizado 2025-06-17 · CVE-2023-46835

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xen (affected versions not specified)

Description The issue arises from a mismatch in the IOMMU quarantine page table levels. On systems with no RAM above the 512GB mark, only 3 page-table levels are configured in the IOMMU, while the quarantine domain is initialized with 4 page table levels. This results in a device in quarantine mode gaining write access to the page destined to be a PDE, potentially leading to data leaks. The sink page the device gets read/write access to is no longer cleared between device assignment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Enumeração de Fraquezas

CWE-264

CWE-787

Identificadores relacionados

BDU:2023-08294

CVE-2023-46835

OPENSUSE-SU-2023_4466-1

OPENSUSE-SU-2023_4475-1

OPENSUSE-SU-2023_4476-1

OPENSUSE-SU-2024:13442-1

SUSE-SU-2023:4466-1

SUSE-SU-2023:4475-1

SUSE-SU-2023:4476-1

SUSE-SU-2023:4484-1

SUSE-SU-2023:4485-1

SUSE-SU-2023:4486-1

SUSE-SU-2023:4945-1

SUSE-SU-2023_4466-1

SUSE-SU-2023_4484-1

SUSE-SU-2023_4485-1

SUSE-SU-2023_4486-1

SUSE-SU-2023_4945-1

Produtos afetados

Debian

Suse

Xen

Referências · 88

• https://bdu.fstec.ru/vul/2023-04662 · Nota de Segurança
• https://lists.suse.com/pipermail/sle-security-updates/2023-November/017126.html · Nota
• https://bugzilla.suse.com/1216807 · Nota
• https://osv.dev/vulnerability/ALPINE-CVE-2023-46835 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-34322.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46835 · Nota
• https://lists.suse.com/pipermail/sle-security-updates/attachments/20231221/27ff2fb1/attachment.htm · Nota
• https://xenbits.xenproject.org/xsa/advisory-445.html · Aviso do Fabricante
• https://lists.suse.com/pipermail/sle-security-updates/attachments/20231120/043c7d5f/attachment.htm · Nota
• https://suse.com/security/cve/CVE-2023-34322 · Nota
• https://security-tracker.debian.org/tracker/source-package/xen · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1743352608687825307 · Publicação no Twitter
• https://suse.com/support/update/announcement/2023/suse-su-20234475-1 · Nota
• https://bugzilla.suse.com/show_bug.cgi?id=1215747 · Nota
• https://lists.suse.com/pipermail/sle-security-updates/attachments/20231120/d153c5ab/attachment.htm · Nota