PT-2024-6308 · Xen+2 · Xen+2

Teddy Astie · Published 2024-01-30 · Updated 2024-11-04 · CVE-2023-46840

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Xen (affected versions not specified)

Description The issue is related to the incorrect placement of a preprocessor directive in the source code, which results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen. This can potentially allow an attacker to elevate privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

CWE-670

Related Identifiers

BDU:2024-07258

CVE-2023-46840

MGASA-2024-0047

OPENSUSE-SU-2024:13648-1

SUSE-SU-2024:0266-1

SUSE-SU-2024:0830-1

Affected Products

Red Os

Suse

Xen

References · 41

• https://osv.dev/vulnerability/openSUSE-SU-2024:13648-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-46840 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-46840 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46840 · Vendor Advisory
• https://xenbits.xenproject.org/xsa/advisory-450.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46840 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0266-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46840 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07258 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:0830-1 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-450.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0047.html · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2023-46840 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-46840 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0047 · Vendor Advisory