Bugzilla – Bug 1219080
VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450)
Last modified: 2024-05-10 17:50:10 UTC
Public: https://xenbits.xen.org/xsa/advisory-450.html Xen Security Advisory CVE-2023-46840 / XSA-450 version 2 VT-d: Failure to quarantine devices in !HVM builds UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen. IMPACT ====== When a device is removed from a domain, it is not properly quarantined and retains its access to the domain to which it was previously assigned. VULNERABLE SYSTEMS ================== Xen 4.17 and onwards are vulnerable. Xen 4.16 and older are not vulnerable. Only Xen running on x86 platforms with an Intel-compatible VT-d IOMMU is vulnerable. Platforms from other manufacturers, or platforms without a VT-d IOMMU are not vulnerable. Only systems where PCI devices are passed through to untrusted or semi-trusted guests are vulnerable. Systems which do not assign PCI devices to untrusted guests are not vulnerable. Xen is only vulnerable when CONFIG_HVM is disabled at build time. Most deployments of Xen are expected to have CONFIG_HVM enabled at build time, and would therefore not be vulnerable. MITIGATION ========== There is no mitigation. CREDITS ======= This issue was discovered by Teddy Astie of Vates RESOLUTION ========== Applying the attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa450.patch xen-unstable - Xen 4.17.x $ sha256sum xsa450* 738c79b92ab5ea57f446df3daff6564727fea5feebf8fadeb32acd0cf06ff9fb xsa450.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html
SUSE-SU-2024:0266-1: An update that solves two vulnerabilities can now be installed. Category: security (moderate) Bug References: 1218851, 1219080 CVE References: CVE-2023-46839, CVE-2023-46840 Sources used: openSUSE Leap 15.5 (src): xen-4.17.3_04-150500.3.21.1 SUSE Linux Enterprise Micro 5.5 (src): xen-4.17.3_04-150500.3.21.1 Basesystem Module 15-SP5 (src): xen-4.17.3_04-150500.3.21.1 Server Applications Module 15-SP5 (src): xen-4.17.3_04-150500.3.21.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Patch submitted for relevant distros.
SUSE-SU-2024:0830-1: An update that solves three vulnerabilities and has one security fix can now be installed. Category: security (moderate) Bug References: 1027519, 1218851, 1219080, 1219885 CVE References: CVE-2023-46839, CVE-2023-46840, CVE-2023-46841 Sources used: openSUSE Leap 15.5 (src): xen-4.17.3_06-150500.3.24.1 SUSE Linux Enterprise Micro 5.5 (src): xen-4.17.3_06-150500.3.24.1 Basesystem Module 15-SP5 (src): xen-4.17.3_06-150500.3.24.1 Server Applications Module 15-SP5 (src): xen-4.17.3_06-150500.3.24.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Done, closing.