DEBIAN-CVE-2023-46837
Dashboard / Vulnerabilities / DEBIAN-CVE-2023-46837
Summary:
Details: Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Unfortunately, the arithmetics in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore there is no guarantee when all the writes will reach the memory. This undefined behavior was meant to be addressed by XSA-437, but the approach was not sufficient.
Affected packages
Package
Name: xen
Purl: pkg:deb/debian/xen?arch=source&distro=bookworm
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -4.17.3+10-g091466ba55-1~deb12u1
Affected versions
4.17.1+2-gb773c48e36-1
4.17.2+55-g0b56bed864-1
4.17.2+76-ge1f9cb16e2-1
4.17.2+76-ge1f9cb16e2-1~deb12u1
4.17.2-1
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
