CVE-2023-46841

{"id": "CVE-2023-46841", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.0}]}, "published": "2024-03-20T11:15:08.220", "references": [{"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZON4TLXG7TG4A2XZG563JMVTGQW4SF3A/", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@xen.org"}, {"url": "https://xenbits.xenproject.org/xsa/advisory-451.html", "tags": ["Patch", "Vendor Advisory"], "source": "security@xen.org"}, {"url": "http://xenbits.xen.org/xsa/advisory-451.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZON4TLXG7TG4A2XZG563JMVTGQW4SF3A/", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://xenbits.xenproject.org/xsa/advisory-451.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Recent x86 CPUs offer functionality named Control-flow Enforcement\nTechnology (CET). A sub-feature of this are Shadow Stacks (CET-SS).\nCET-SS is a hardware feature designed to protect against Return Oriented\nProgramming attacks. When enabled, traditional stacks holding both data\nand return addresses are accompanied by so called \"shadow stacks\",\nholding little more than return addresses. Shadow stacks aren't\nwritable by normal instructions, and upon function returns their\ncontents are used to check for possible manipulation of a return address\ncoming from the traditional stack.\n\nIn particular certain memory accesses need intercepting by Xen. In\nvarious cases the necessary emulation involves kind of replaying of\nthe instruction. Such replaying typically involves filling and then\ninvoking of a stub. Such a replayed instruction may raise an\nexceptions, which is expected and dealt with accordingly.\n\nUnfortunately the interaction of both of the above wasn't right:\nRecovery involves removal of a call frame from the (traditional) stack.\nThe counterpart of this operation for the shadow stack was missing."}, {"lang": "es", "value": "Las CPU x86 recientes ofrecen una funcionalidad denominada Control-flow Enforcement Technology (CET). Una subcaracter\u00edstica de esto son Shadow Stacks (CET-SS). CET-SS es una caracter\u00edstica de hardware manipulada para proteger contra ataques de programaci\u00f3n orientada al retorno. Cuando est\u00e1n habilitadas, las pilas tradicionales que contienen datos y direcciones de retorno van acompa\u00f1adas de las llamadas \"pilas ocultas\", que contienen poco m\u00e1s que direcciones de retorno. Las pilas de sombra no se pueden escribir mediante instrucciones normales y, cuando la funci\u00f3n regresa, su contenido se usa para verificar una posible manipulaci\u00f3n de una direcci\u00f3n de retorno proveniente de la pila tradicional. En particular, ciertos accesos a la memoria necesitan ser interceptados por Xen. En varios casos, la emulaci\u00f3n necesaria implica una especie de repetici\u00f3n de la instrucci\u00f3n. Esta reproducci\u00f3n normalmente implica llenar y luego invocar un trozo. Una instrucci\u00f3n repetida de este tipo puede generar excepciones, lo cual se espera y se trata en consecuencia. Desafortunadamente, la interacci\u00f3n de los dos anteriores no fue correcta: la recuperaci\u00f3n implica la eliminaci\u00f3n de un marco de llamada de la pila (tradicional). Faltaba la contraparte de esta operaci\u00f3n para la pila de sombra."}], "lastModified": "2025-05-12T15:06:58.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA277A6C-83EC-4536-9125-97B84C4FAF59"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "73CA7EB6-4464-4294-B859-0C8DD3AB7E86", "versionStartIncluding": "4.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@xen.org"}