Xen 4.15.x/4.16.x/4.17.x/4.18.x x86 HVM Hypercall denial of service

Summaryinfo

A vulnerability categorized as critical has been discovered in Xen 4.15.x/4.16.x/4.17.x/4.18.x. The affected element is an unknown function of the component x86 HVM Hypercall Handler. The manipulation results in denial of service. This vulnerability was named CVE-2023-46842. The attack needs to be approached locally. There is no available exploit. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability classified as critical has been found in Xen 4.15.x/4.16.x/4.17.x/4.18.x. Affected is an unknown functionality of the component x86 HVM Hypercall Handler. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. CVE summarizes:

Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass 32-bit-mode hypercall arguments to values outside of the range 32-bit code would be able to set them to. When processing of hypercalls takes a considerable amount of time, the hypervisor may choose to invoke a hypercall continuation. Doing so involves putting (perhaps updated) hypercall arguments in respective registers. For guests not running in 64-bit mode this further involves a certain amount of translation of the values. Unfortunately internal sanity checking of these translated values assumes high halves of registers to always be clear when invoking a hypercall. When this is found not to be the case, it triggers a consistency check in the hypervisor and causes a crash.

The advisory is shared for download at xenbits.xen.org. This vulnerability is traded as CVE-2023-46842 since 10/27/2023. The exploitability is told to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 213392 (Debian dsa-5836 : libxen-dev - security update), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Tenable (213392). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Virtualization Software

Name

• Xen

Version

• 4.15.x
• 4.16.x
• 4.17.x
• 4.18.x

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion