Skip to content
OpenAdvisories
Medium · 6.5 CVE-2023-46842 EUVD-2023-51008GHSA-hcr5-hp8w-36q9

x86 HVM hypercalls may trigger Xen bug check

Published May 16, 2024 · Updated Nov 4, 2025 · Assigned by XEN

Description

Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and
other modes. This in particular means that they may set registers used
to pass 32-bit-mode hypercall arguments to values outside of the range
32-bit code would be able to set them to.

When processing of hypercalls takes a considerable amount of time,
the hypervisor may choose to invoke a hypercall continuation. Doing so
involves putting (perhaps updated) hypercall arguments in respective
registers. For guests not running in 64-bit mode this further involves
a certain amount of translation of the values.

Unfortunately internal sanity checking of these translated values
assumes high halves of registers to always be clear when invoking a
hypercall. When this is found not to be the case, it triggers a
consistency check in the hypervisor and causes a crash.

Affected products

VendorProductAffectedFixed
Xen Xen — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 xen 4.19.1-1 —
Debian 13 xen 4.19.1-1 —
Debian 12 xen 4.17.5+23-ga4e5191dc0-1 DSA-5836-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 xen No fix yet —
Ubuntu 26.04 LTS xen No fix yet —
Ubuntu 25.10 xen No fix yet —
Ubuntu 24.04 LTS xen No fix yet —
Ubuntu 22.04 LTS xen No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS xen No fix yet —
Ubuntu 18.04 LTS xen No fix yet —
Ubuntu 16.04 LTS xen No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP6 xen 4.18.2_06-150600.3.3.1 SUSE-SU-2024:2531-1
SLES 15 SP5 xen 4.17.4_02-150500.3.30.1 SUSE-SU-2024:2654-1, SUSE-SU-2024:1295-1
SLES 15 SP2 xen 4.13.5_12-150200.3.93.1 SUSE-SU-2024:2535-1
SLES 12 SP5 xen 4.12.4_48-3.109.1 SUSE-SU-2024:1541-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP2 xen 4.13.5_12-150200.3.93.1 SUSE-SU-2024:2535-1
SLES for SAP 12 SP5 xen 4.12.4_48-3.109.1 SUSE-SU-2024:1541-1
SLE Micro 5.5 xen 4.17.4_02-150500.3.30.1 SUSE-SU-2024:2654-1, SUSE-SU-2024:1295-1
SLE Micro 5.4 xen 4.16.6_02-150400.4.55.1 SUSE-SU-2024:1259-1
SLE Micro 5.3 xen 4.16.6_02-150400.4.55.1 SUSE-SU-2024:1259-1
SLE Micro 5.2 xen 4.14.6_14-150300.3.72.1 SUSE-SU-2024:1540-1
SLE Micro 5.1 xen 4.14.6_14-150300.3.72.1 SUSE-SU-2024:1540-1
SLE HPC 15 SP2 xen 4.13.5_12-150200.3.93.1 SUSE-SU-2024:2535-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed xen 4.18.2_02-1.1 openSUSE-SU-2024:13853-1
openSUSE Leap 15.6 xen 4.18.2_06-150600.3.3.1 SUSE-SU-2024:2531-1
openSUSE Leap 15.5 xen 4.17.4_02-150500.3.30.1 SUSE-SU-2024:2654-1, SUSE-SU-2024:1295-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.5 xen 4.17.4_04-150500.3.33.1 SUSE-SU-2024:2654-1
openSUSE Leap Micro 5.4 xen 4.16.6_02-150400.4.55.1 SUSE-SU-2024:1259-1
openSUSE Leap Micro 5.3 xen 4.16.6_02-150400.4.55.1 SUSE-SU-2024:1259-1
ReleasePackageFixed inAdvisory
Alpine v3.24 xen 4.18.2-r0 —
Alpine v3.23 xen 4.18.2-r0 —
Alpine v3.22 xen 4.18.2-r0 —
Alpine v3.21 xen 4.18.2-r0 —
Alpine v3.20 xen 4.18.2-r0 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 xen 4.18.2-r0 —
Alpine v3.18 xen 4.17.4-r0 —
Alpine v3.17 xen 4.16.6-r0 —
Alpine v3.16 xen 4.16.6-r0 —

Advisories 10

References