{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-21T03:45:12.415","vulnerabilities":[{"cve":{"id":"CVE-2023-46836","sourceIdentifier":"security@xen.org","published":"2024-01-05T17:15:11.197","lastModified":"2025-11-04T20:17:10.557","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative\nReturn Stack Overflow) are not IRQ-safe.  It was believed that the\nmitigations always operated in contexts with IRQs disabled.\n\nHowever, the original XSA-254 fix for Meltdown (XPTI) deliberately left\ninterrupts enabled on two entry paths; one unconditionally, and one\nconditionally on whether XPTI was active.\n\nAs BTC/SRSO and Meltdown affect different CPU vendors, the mitigations\nare not active together by default.  Therefore, there is a race\ncondition whereby a malicious PV guest can bypass BTC/SRSO protections\nand launch a BTC/SRSO attack against Xen.\n"},{"lang":"es","value":"Las correcciones para XSA-422 (Branch Type Confusion) y XSA-434 (Speculative Return Stack Overflow) no son seguras para IRQ. Se creía que las mitigaciones siempre operaban en contextos con las IRQ deshabilitadas. Sin embargo, la solución XSA-254 original para Meltdown (XPTI) deliberadamente dejó habilitadas las interrupciones en dos rutas de entrada; uno incondicionalmente y otro condicionalmente sobre si XPTI estaba activo. Como BTC/SRSO y Meltdown afectan a diferentes proveedores de CPU, las mitigaciones no están activas juntas de forma predeterminada. Por lo tanto, existe una condición de ejecución mediante la cual un invitado PV malicioso puede eludir las protecciones BTC/SRSO y lanzar un ataque BTC/SRSO contra Xen."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":3.6},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*","matchCriteriaId":"C2B9CCC2-BAC5-4A65-B8D4-4B71EBBA0C2F"}]}]}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-446.html","source":"security@xen.org","tags":["Patch","Vendor Advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-446.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://xenbits.xenproject.org/xsa/advisory-446.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]}]}}]}