certfr_avis - CERTFR-2024-AVI-0082

CERTFR-2024-AVI-0082

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Xen. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
XEN	Xen	Xen versions 4.16.x sans le dernier correctif de sécurité
XEN	Xen	Xen versions 4.15.x sans le dernier correctif de sécurité
XEN	Xen	Xen versions 4.17.x sans le dernier correctif de sécurité

References

Title

Publication Time

Tags

Bulletin de sécurité Xen XSA-449 du 30 janvier 2024	None	vendor-advisory
Bulletin de sécurité Xen XSA-450 du 30 janvier 2024	None	vendor-advisory
Bulletin de sécurité Xen XSA-450 du 30 janvier 2024	-	other
Bulletin de sécurité Xen XSA-449 du 30 janvier 2024	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Xen versions 4.16.x sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Xen",
        "vendor": {
          "name": "XEN",
          "scada": false
        }
      }
    },
    {
      "description": "Xen versions 4.15.x sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Xen",
        "vendor": {
          "name": "XEN",
          "scada": false
        }
      }
    },
    {
      "description": "Xen versions 4.17.x sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Xen",
        "vendor": {
          "name": "XEN",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-46840",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46840"
    },
    {
      "name": "CVE-2023-46839",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46839"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Xen\u00a0XSA-450 du 30 janvier 2024",
      "url": "https://xenbits.xen.org/xsa/advisory-450.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Xen\u00a0XSA-449 du 30 janvier 2024",
      "url": "https://xenbits.xen.org/xsa/advisory-449.html"
    }
  ],
  "reference": "CERTFR-2024-AVI-0082",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-01-31T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Xen\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer un contournement de la politique de s\u00e9curit\u00e9 et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Xen",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Xen XSA-449 du 30 janvier 2024",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Xen XSA-450 du 30 janvier 2024",
      "url": null
    }
  ]
}

CVE-2023-46840 (GCVE-0-2023-46840)

Vulnerability from cvelistv5 – Published: 2024-03-20 10:40 – Updated: 2025-11-04 18:18

Summary

Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen.

Severity ?

4.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-noinfo Not enough information

Assigner

XEN

References

URL

Tags

https://xenbits.xenproject.org/xsa/advisory-450.html

Impacted products

	Vendor	Product	Version
	Xen	Xen	Unknown: consult Xen advisory XSA-450

Credits

This issue was discovered by Teddy Astie of Vates

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:18:56.351Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://xenbits.xenproject.org/xsa/advisory-450.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XLL6SQ6IKFYXLYWITYZCRV5IBRK5G35R/"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-450.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 4.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-46840",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-05T18:59:02.763689Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-04T21:39:44.430Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-450"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Xen 4.17 and onwards are vulnerable.  Xen 4.16 and older are not\nvulnerable.\n\nOnly Xen running on x86 platforms with an Intel-compatible VT-d IOMMU is\nvulnerable.  Platforms from other manufacturers, or platforms without a\nVT-d IOMMU are not vulnerable.\n\nOnly systems where PCI devices are passed through to untrusted or\nsemi-trusted guests are vulnerable.  Systems which do not assign PCI\ndevices to untrusted guests are not vulnerable.\n\nXen is only vulnerable when CONFIG_HVM is disabled at build time.  Most\ndeployments of Xen are expected to have CONFIG_HVM enabled at build\ntime, and would therefore not be vulnerable.\n"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Teddy Astie of Vates\n"
        }
      ],
      "datePublic": "2024-01-30T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect placement of a preprocessor directive in source code results\nin logic that doesn\u0027t operate as intended when support for HVM guests is\ncompiled out of Xen.\n"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "When a device is removed from a domain, it is not properly quarantined\nand retains its access to the domain to which it was previously\nassigned.\n"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-20T10:40:18.050Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-450.html"
        }
      ],
      "title": "VT-d: Failure to quarantine devices in !HVM builds",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no mitigation.\n"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2023-46840",
    "datePublished": "2024-03-20T10:40:18.050Z",
    "dateReserved": "2023-10-27T07:55:35.333Z",
    "dateUpdated": "2025-11-04T18:18:56.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-46839 (GCVE-0-2023-46839)

Vulnerability from cvelistv5 – Published: 2024-03-20 10:35 – Updated: 2025-11-04 18:18

Summary

PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-noinfo Not enough information

Assigner

XEN

References

URL

Tags

https://xenbits.xenproject.org/xsa/advisory-449.html

Impacted products

	Vendor	Product	Version
	Xen	Xen	Unknown: consult Xen advisory XSA-449

Credits

This issue was discovered by Roger Pau Monné of XenServer.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:18:53.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://xenbits.xenproject.org/xsa/advisory-449.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XLL6SQ6IKFYXLYWITYZCRV5IBRK5G35R/"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-449.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-46839",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-06T14:00:00.793454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-21T19:17:55.653Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-449"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Systems running all version of Xen are affected.\n\nOnly x86 systems are vulnerable.  Arm systems are not vulnerable.\n\nOnly systems using PCI passthrough of devices with phantom functions\nare affected.\n"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Roger Pau Monn\u00e9 of XenServer.\n"
        }
      ],
      "datePublic": "2024-01-30T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PCI devices can make use of a functionality called phantom functions,\nthat when enabled allows the device to generate requests using the IDs\nof functions that are otherwise unpopulated.  This allows a device to\nextend the number of outstanding requests.\n\nSuch phantom functions need an IOMMU context setup, but failure to\nsetup the context is not fatal when the device is assigned.  Not\nfailing device assignment when such failure happens can lead to the\nprimary device being assigned to a guest, while some of the phantom\nfunctions are assigned to a different domain.\n"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Under certain circumstances a malicious guest assigned a PCI device\nwith phantom functions may be able to access memory from a previous\nowner of the device.\n"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-20T10:35:52.532Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-449.html"
        }
      ],
      "title": "pci: phantom functions assigned to incorrect contexts",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no mitigation (other than not passing through PCI devices\nwith phantom functions to guests).\n"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2023-46839",
    "datePublished": "2024-03-20T10:35:52.532Z",
    "dateReserved": "2023-10-27T07:55:35.332Z",
    "dateUpdated": "2025-11-04T18:18:53.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2024-AVI-0082

Solution

CVE-2023-46840 (GCVE-0-2023-46840)

CVE-2023-46839 (GCVE-0-2023-46839)

Tags

Sightings

Nomenclature