Xen Shadow Stack stack-based overflow

Summaryinfo

A vulnerability, which was classified as critical, was found in Xen. This affects an unknown function of the component Shadow Stack Handler. Such manipulation leads to stack-based overflow. This vulnerability is referenced as CVE-2023-46841. No exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Xen (Virtualization Software) (affected version not known). Affected by this issue is some unknown functionality of the component Shadow Stack Handler. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability. CVE summarizes:

Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this are Shadow Stacks (CET-SS). CET-SS is a hardware feature designed to protect against Return Oriented Programming attacks. When enabled, traditional stacks holding both data and return addresses are accompanied by so called "shadow stacks", holding little more than return addresses. Shadow stacks aren't writable by normal instructions, and upon function returns their contents are used to check for possible manipulation of a return address coming from the traditional stack. In particular certain memory accesses need intercepting by Xen. In various cases the necessary emulation involves kind of replaying of the instruction. Such replaying typically involves filling and then invoking of a stub. Such a replayed instruction may raise an exceptions, which is expected and dealt with accordingly. Unfortunately the interaction of both of the above wasn't right: Recovery involves removal of a call frame from the (traditional) stack. The counterpart of this operation for the shadow stack was missing.

The weakness was published 02/27/2024. The advisory is shared for download at xenbits.xen.org. This vulnerability is handled as CVE-2023-46841 since 10/27/2023. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 213392 (Debian dsa-5836 : libxen-dev - security update), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Tenable (213392). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Virtualization Software

Name

• Xen

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion