CVE-2023-46842

x86 HVM hypercalls may trigger Xen bug check

Description

Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass 32-bit-mode hypercall arguments to values outside of the range 32-bit code would be able to set them to. When processing of hypercalls takes a considerable amount of time, the hypervisor may choose to invoke a hypercall continuation. Doing so involves putting (perhaps updated) hypercall arguments in respective registers. For guests not running in 64-bit mode this further involves a certain amount of translation of the values. Unfortunately internal sanity checking of these translated values assumes high halves of registers to always be clear when invoking a hypercall. When this is found not to be the case, it triggers a consistency check in the hypervisor and causes a crash.

Remediation

Workaround:

  • Not using HVM / PVH guests will avoid the vulnerability.

Category

6.5
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 6.49% Top 10%
Affected: Xen Xen
Published at:
Updated at:

References

Frequently Asked Questions

What is the severity of CVE-2023-46842?
CVE-2023-46842 has been scored as a medium severity vulnerability.
How to fix CVE-2023-46842?
As a workaround for remediating CVE-2023-46842: Not using HVM / PVH guests will avoid the vulnerability.
Is CVE-2023-46842 being actively exploited in the wild?
It is possible that CVE-2023-46842 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~6% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-46842?
CVE-2023-46842 affects Xen Xen.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.