The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations are not active together by default. Therefore, there is a race condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack against Xen.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4945-1 advisory.

  - x86/AMD: mismatch in IOMMU quarantine page table levels [XSA-445, CVE-2023-46835] x86: BTC/SRSO fixes not     fully effective [XSA-446, CVE-2023-46836] (CVE-2023-46835, CVE-2023-46836)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e62da41072 advisory.

  - The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been     initialized with an address width of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and hence 4 page table levels.
    However dom_io being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum (hot     pluggable) RAM address, and hence on systems with no RAM above the 512GB mark only 3 page-table levels are     configured in the IOMMU. On systems without RAM above the 512GB boundary amd_iommu_quarantine_init() will     setup page tables for the scratch page with 4 levels, while the IOMMU will be configured to use 3 levels     only, resulting in the last page table directory (PDE) effectively becoming a page table entry (PTE), and     hence a device in quarantine mode gaining write access to the page destined to be a PDE. Due to this page     table level mismatch, the sink page the device gets read/write access to is no longer cleared between     device assignment, possibly leading to data leaks. (CVE-2023-46835)

  - The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-     safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the     original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one     unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and Meltdown affect     different CPU vendors, the mitigations are not active together by default. Therefore, there is a race     condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack     against Xen. (CVE-2023-46836)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-56901a79a1 advisory.

  - The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been     initialized with an address width of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and hence 4 page table levels.
    However dom_io being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum (hot     pluggable) RAM address, and hence on systems with no RAM above the 512GB mark only 3 page-table levels are     configured in the IOMMU. On systems without RAM above the 512GB boundary amd_iommu_quarantine_init() will     setup page tables for the scratch page with 4 levels, while the IOMMU will be configured to use 3 levels     only, resulting in the last page table directory (PDE) effectively becoming a page table entry (PTE), and     hence a device in quarantine mode gaining write access to the page destined to be a PDE. Due to this page     table level mismatch, the sink page the device gets read/write access to is no longer cleared between     device assignment, possibly leading to data leaks. (CVE-2023-46835)

  - The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-     safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the     original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one     unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and Meltdown affect     different CPU vendors, the mitigations are not active together by default. Therefore, there is a race     condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack     against Xen. (CVE-2023-46836)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-fa01e4c6ba advisory.

  - The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been     initialized with an address width of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and hence 4 page table levels.
    However dom_io being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum (hot     pluggable) RAM address, and hence on systems with no RAM above the 512GB mark only 3 page-table levels are     configured in the IOMMU. On systems without RAM above the 512GB boundary amd_iommu_quarantine_init() will     setup page tables for the scratch page with 4 levels, while the IOMMU will be configured to use 3 levels     only, resulting in the last page table directory (PDE) effectively becoming a page table entry (PTE), and     hence a device in quarantine mode gaining write access to the page destined to be a PDE. Due to this page     table level mismatch, the sink page the device gets read/write access to is no longer cleared between     device assignment, possibly leading to data leaks. (CVE-2023-46835)

  - The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-     safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the     original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one     unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and Meltdown affect     different CPU vendors, the mitigations are not active together by default. Therefore, there is a race     condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack     against Xen. (CVE-2023-46836)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe as it was believed that the mitigations were always operated in contexts with IRQs disabled. However due to an unanticipated interaction with XSA-254 (Meltdown), a race condition exists whereby a malicious guest can bypass BTC/SRSO protections.
As a result, an attacker in a PV guest can infer the contents of memory belonging to other guests.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4484-1 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4485-1 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4486-1 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4476-1 advisory.

  - A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality. (CVE-2023-20588)

  - arm32: The cache may not be properly cleaned/invalidated [XSA-437, CVE-2023-34321] top-level shadow     reference dropped too early for 64-bit PV guests [XSA-438, CVE-2023-34322] x86/AMD: Divide speculative     information leak [XSA-439, CVE-2023-20588] (CVE-2023-34322)

  - The vulnerability exists due to insufficient validation of user-supplied input in libfsimage. A remote     guest can use pygrab to trigger stack-based buffer overflow and execute arbitrary code on the host system     (CVE-2023-34325)

  - The vulnerability exists due to missing IOMMU TLB flushing on x86/AMD systems. A malicious guest can     access memory not owned by the guest and escalate privileges on the system. (CVE-2023-34326)

  - The vulnerability exists due to improper validation of guest state when using Debug Masks in HVM vCPU. A     malicious guest can perform a denial of service (DoS) attack against the guest OS. (CVE-2023-34327)

  - The vulnerability exists due to improper validation of guest state in PV vCPU. A malicious guest place a     breakpoint over the live GDT and perform a denial of service (DoS) attack against the host.
    (CVE-2023-34328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4475-1 advisory.

  - A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality. (CVE-2023-20588)

  - arm32: The cache may not be properly cleaned/invalidated [XSA-437, CVE-2023-34321] top-level shadow     reference dropped too early for 64-bit PV guests [XSA-438, CVE-2023-34322] x86/AMD: Divide speculative     information leak [XSA-439, CVE-2023-20588] (CVE-2023-34322)

  - The vulnerability exists due to insufficient validation of user-supplied input in libfsimage. A remote     guest can use pygrab to trigger stack-based buffer overflow and execute arbitrary code on the host system     (CVE-2023-34325)

  - The vulnerability exists due to missing IOMMU TLB flushing on x86/AMD systems. A malicious guest can     access memory not owned by the guest and escalate privileges on the system. (CVE-2023-34326)

  - The vulnerability exists due to improper validation of guest state when using Debug Masks in HVM vCPU. A     malicious guest can perform a denial of service (DoS) attack against the guest OS. (CVE-2023-34327)

  - The vulnerability exists due to improper validation of guest state in PV vCPU. A malicious guest place a     breakpoint over the live GDT and perform a denial of service (DoS) attack against the host.
    (CVE-2023-34328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4466-1 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
187177	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xen (SUSE-SU-2023:4945-1)	Nessus	SuSE Local Security Checks	medium
186496	Fedora 37 : xen (2023-e62da41072)	Nessus	Fedora Local Security Checks	medium
186460	Fedora 38 : xen (2023-56901a79a1)	Nessus	Fedora Local Security Checks	medium
186457	Fedora 39 : xen (2023-fa01e4c6ba)	Nessus	Fedora Local Security Checks	medium
186415	Xen: x86: BTC/SRSO Fixes Not Fully Effective (XSA-446)	Nessus	Misc.	medium
186026	SUSE SLES15 Security Update : xen (SUSE-SU-2023:4484-1)	Nessus	SuSE Local Security Checks	medium
186023	SUSE SLES15 Security Update : xen (SUSE-SU-2023:4485-1)	Nessus	SuSE Local Security Checks	medium
186022	SUSE SLES12 Security Update : xen (SUSE-SU-2023:4486-1)	Nessus	SuSE Local Security Checks	medium
185977	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xen (SUSE-SU-2023:4476-1)	Nessus	SuSE Local Security Checks	high
185975	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xen (SUSE-SU-2023:4475-1)	Nessus	SuSE Local Security Checks	high
185936	SUSE SLES15 Security Update : xen (SUSE-SU-2023:4466-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-46836

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium