GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-46836 (GCVE-0-2023-46836)

Vulnerability from cvelistv5 – Published: 2024-01-05 16:34 – Updated: 2025-11-04 19:25
VLAI
Title
x86: BTC/SRSO fixes not fully effective
Summary
The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations are not active together by default. Therefore, there is a race condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack against Xen.
Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-08 20:16 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Xen Xen Unknown: consult Xen advisory XSA-446
guessed Create a notification for this product.
Date Public
2023-11-14 12:00
Credits
This issue was discovered by Andrew Cooper of XenServer.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T19:25:42.692Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://xenbits.xenproject.org/xsa/advisory-446.html"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-446.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-46836",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T20:16:12.540203Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T14:40:56.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-446"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All versions of Xen are vulnerable.\n\nXen is only vulnerable in default configurations on AMD and Hygon CPUs.\n\nXen is not believed to be vulnerable in default configurations on CPUs\nfrom other hardware vendors.\n\nOnly PV guests can leverage the vulnerability.\n"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Andrew Cooper of XenServer.\n"
        }
      ],
      "datePublic": "2023-11-14T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative\nReturn Stack Overflow) are not IRQ-safe.  It was believed that the\nmitigations always operated in contexts with IRQs disabled.\n\nHowever, the original XSA-254 fix for Meltdown (XPTI) deliberately left\ninterrupts enabled on two entry paths; one unconditionally, and one\nconditionally on whether XPTI was active.\n\nAs BTC/SRSO and Meltdown affect different CPU vendors, the mitigations\nare not active together by default.  Therefore, there is a race\ncondition whereby a malicious PV guest can bypass BTC/SRSO protections\nand launch a BTC/SRSO attack against Xen.\n"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker in a PV guest might be able to infer the contents of memory\nbelonging to other guests.\n"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-05T16:34:59.036Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-446.html"
        }
      ],
      "title": "x86: BTC/SRSO fixes not fully effective",
      "workarounds": [
        {
          "lang": "en",
          "value": "Running only HVM or PVH VMs will avoid the vulnerability.\n"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2023-46836",
    "datePublished": "2024-01-05T16:34:59.036Z",
    "dateReserved": "2023-10-27T07:55:35.332Z",
    "dateUpdated": "2025-11-04T19:25:42.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-46836",
      "date": "2026-09-16",
      "epss": "0.0025",
      "percentile": "0.16495"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C2B9CCC2-BAC5-4A65-B8D4-4B71EBBA0C2F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative\\nReturn Stack Overflow) are not IRQ-safe.  It was believed that the\\nmitigations always operated in contexts with IRQs disabled.\\n\\nHowever, the original XSA-254 fix for Meltdown (XPTI) deliberately left\\ninterrupts enabled on two entry paths; one unconditionally, and one\\nconditionally on whether XPTI was active.\\n\\nAs BTC/SRSO and Meltdown affect different CPU vendors, the mitigations\\nare not active together by default.  Therefore, there is a race\\ncondition whereby a malicious PV guest can bypass BTC/SRSO protections\\nand launch a BTC/SRSO attack against Xen.\\n\"}, {\"lang\": \"es\", \"value\": \"Las correcciones para XSA-422 (Branch Type Confusion) y XSA-434 (Speculative Return Stack Overflow) no son seguras para IRQ. Se cre\\u00eda que las mitigaciones siempre operaban en contextos con las IRQ deshabilitadas. Sin embargo, la soluci\\u00f3n XSA-254 original para Meltdown (XPTI) deliberadamente dej\\u00f3 habilitadas las interrupciones en dos rutas de entrada; uno incondicionalmente y otro condicionalmente sobre si XPTI estaba activo. Como BTC/SRSO y Meltdown afectan a diferentes proveedores de CPU, las mitigaciones no est\\u00e1n activas juntas de forma predeterminada. Por lo tanto, existe una condici\\u00f3n de ejecuci\\u00f3n mediante la cual un invitado PV malicioso puede eludir las protecciones BTC/SRSO y lanzar un ataque BTC/SRSO contra Xen.\"}]",
      "id": "CVE-2023-46836",
      "lastModified": "2024-11-21T08:29:23.713",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 3.6}]}",
      "published": "2024-01-05T17:15:11.197",
      "references": "[{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-446.html\", \"source\": \"security@xen.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://xenbits.xenproject.org/xsa/advisory-446.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@xen.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-46836\",\"sourceIdentifier\":\"security@xen.org\",\"published\":\"2024-01-05T17:15:11.197\",\"lastModified\":\"2026-06-17T06:31:43.523\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative\\nReturn Stack Overflow) are not IRQ-safe.  It was believed that the\\nmitigations always operated in contexts with IRQs disabled.\\n\\nHowever, the original XSA-254 fix for Meltdown (XPTI) deliberately left\\ninterrupts enabled on two entry paths; one unconditionally, and one\\nconditionally on whether XPTI was active.\\n\\nAs BTC/SRSO and Meltdown affect different CPU vendors, the mitigations\\nare not active together by default.  Therefore, there is a race\\ncondition whereby a malicious PV guest can bypass BTC/SRSO protections\\nand launch a BTC/SRSO attack against Xen.\\n\"},{\"lang\":\"es\",\"value\":\"Las correcciones para XSA-422 (Branch Type Confusion) y XSA-434 (Speculative Return Stack Overflow) no son seguras para IRQ. Se cre\u00eda que las mitigaciones siempre operaban en contextos con las IRQ deshabilitadas. Sin embargo, la soluci\u00f3n XSA-254 original para Meltdown (XPTI) deliberadamente dej\u00f3 habilitadas las interrupciones en dos rutas de entrada; uno incondicionalmente y otro condicionalmente sobre si XPTI estaba activo. Como BTC/SRSO y Meltdown afectan a diferentes proveedores de CPU, las mitigaciones no est\u00e1n activas juntas de forma predeterminada. Por lo tanto, existe una condici\u00f3n de ejecuci\u00f3n mediante la cual un invitado PV malicioso puede eludir las protecciones BTC/SRSO y lanzar un ataque BTC/SRSO contra Xen.\"}],\"affected\":[{\"source\":\"security@xen.org\",\"affectedData\":[{\"vendor\":\"Xen\",\"product\":\"Xen\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"consult Xen advisory XSA-446\",\"status\":\"unknown\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-05-08T20:16:12.540203Z\",\"id\":\"CVE-2023-46836\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2B9CCC2-BAC5-4A65-B8D4-4B71EBBA0C2F\"}]}]}],\"references\":[{\"url\":\"https://xenbits.xenproject.org/xsa/advisory-446.html\",\"source\":\"security@xen.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://xenbits.xen.org/xsa/advisory-446.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://xenbits.xenproject.org/xsa/advisory-446.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-29T00:15:49+00:00",
      "cve": "CVE-2023-46836",
      "id": "CVE-2023-46836",
      "initial_release_date": "2023-11-14T12:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "x86: BTC/SRSO fixes not fully effective",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-46836.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:50:34Z",
      "cve": "CVE-2023-46836",
      "id": "CVE-2023-46836",
      "initial_release_date": "2023-11-17T02:00:59Z",
      "product_status:known_affected": "275",
      "product_status:recommended": "418",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-46836",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-46836.json",
      "version": "50"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-446.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://xenbits.xen.org/xsa/advisory-446.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T19:25:42.692Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-46836\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-08T20:16:12.540203Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-08T20:16:14.257Z\"}}], \"cna\": {\"title\": \"x86: BTC/SRSO fixes not fully effective\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This issue was discovered by Andrew Cooper of XenServer.\\n\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"An attacker in a PV guest might be able to infer the contents of memory\\nbelonging to other guests.\\n\"}]}], \"affected\": [{\"vendor\": \"Xen\", \"product\": \"Xen\", \"versions\": [{\"status\": \"unknown\", \"version\": \"consult Xen advisory XSA-446\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2023-11-14T12:00:00.000Z\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-446.html\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Running only HVM or PVH VMs will avoid the vulnerability.\\n\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative\\nReturn Stack Overflow) are not IRQ-safe.  It was believed that the\\nmitigations always operated in contexts with IRQs disabled.\\n\\nHowever, the original XSA-254 fix for Meltdown (XPTI) deliberately left\\ninterrupts enabled on two entry paths; one unconditionally, and one\\nconditionally on whether XPTI was active.\\n\\nAs BTC/SRSO and Meltdown affect different CPU vendors, the mitigations\\nare not active together by default.  Therefore, there is a race\\ncondition whereby a malicious PV guest can bypass BTC/SRSO protections\\nand launch a BTC/SRSO attack against Xen.\\n\"}], \"configurations\": [{\"lang\": \"en\", \"value\": \"All versions of Xen are vulnerable.\\n\\nXen is only vulnerable in default configurations on AMD and Hygon CPUs.\\n\\nXen is not believed to be vulnerable in default configurations on CPUs\\nfrom other hardware vendors.\\n\\nOnly PV guests can leverage the vulnerability.\\n\"}], \"providerMetadata\": {\"orgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"shortName\": \"XEN\", \"dateUpdated\": \"2024-01-05T16:34:59.036Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-46836\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-04T19:25:42.692Z\", \"dateReserved\": \"2023-10-27T07:55:35.332Z\", \"assignerOrgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"datePublished\": \"2024-01-05T16:34:59.036Z\", \"assignerShortName\": \"XEN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.