CVE-2023-46837: arm32: The cache may not be properly cleaned/invalidated (take two)
Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest.
Unfortunately, the arithmetics in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore there is no guarantee when all the writes will reach the memory.
This undefined behavior was meant to be addressed by XSA-437, but the approach was not sufficient.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46837?
CVE-2023-46837 has a high severity rating due to its potential impact on cache management and memory handling.
How do I fix CVE-2023-46837?
To fix CVE-2023-46837, upgrade Xen to a version later than 4.16 that addresses this vulnerability.
What software is affected by CVE-2023-46837?
CVE-2023-46837 affects Xen versions up to and including 4.16 running on x86 architectures.
What kind of vulnerability is CVE-2023-46837?
CVE-2023-46837 is a vulnerability related to improper management of cache cleaning and invalidation.
Is there a workaround for CVE-2023-46837?
Currently, the best approach for CVE-2023-46837 is to apply the recommended updates rather than rely on a workaround.