Xen 4.15/4.16/4.17 IOMMU Quarantine Page Table Level iommu_map.c amd_iommu_quarantine_init memory corruption

Summaryinfo

A vulnerability has been found in Xen 4.15/4.16/4.17 and classified as critical. Affected by this vulnerability is the function amd_iommu_quarantine_init of the file xen/drivers/passthrough/amd/iommu_map.c of the component IOMMU Quarantine Page Table Level Handler. Performing a manipulation results in memory corruption. This vulnerability is reported as CVE-2023-46835. No exploit exists. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Xen 4.15/4.16/4.17 (Virtualization Software). It has been classified as critical. This affects the function amd_iommu_quarantine_init of the file xen/drivers/passthrough/amd/iommu_map.c of the component IOMMU Quarantine Page Table Level Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been initialized with an address width of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and hence 4 page table levels. However dom_io being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum (hot pluggable) RAM address, and hence on systems with no RAM above the 512GB mark only 3 page-table levels are configured in the IOMMU. On systems without RAM above the 512GB boundary amd_iommu_quarantine_init() will setup page tables for the scratch page with 4 levels, while the IOMMU will be configured to use 3 levels only, resulting in the last page table directory (PDE) effectively becoming a page table entry (PTE), and hence a device in quarantine mode gaining write access to the page destined to be a PDE. Due to this page table level mismatch, the sink page the device gets read/write access to is no longer cleared between device assignment, possibly leading to data leaks.

The weakness was disclosed 11/14/2023. The advisory is shared at xenbits.xen.org. This vulnerability is uniquely identified as CVE-2023-46835 since 10/27/2023. Technical details are known, but no exploit is available.

Applying a patch is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Virtualization Software

Name

• Xen

Version

• 4.15
• 4.16
• 4.17

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion