The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations are not active together by default. Therefore, there is a race condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack against Xen.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: XEN

Published: 2024-01-05T16:34:59.036Z

Updated: 2024-08-02T20:53:21.940Z

Reserved: 2023-10-27T07:55:35.332Z

Link: CVE-2023-46836

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2024-01-05T17:15:11.197

Modified: 2024-11-21T08:29:23.713

Link: CVE-2023-46836

cve-icon Redhat

No data.