CVE-2023-46837: arm32: The cache may not be properly cleaned/invalidated (take two)

Vulnerability summary

CVE-2023-46837 is a low (CVSS 3.3) vulnerability in xen. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 15.3% of scored vulnerabilities.

Timeline

1. 05-01-2024
   PublishedVulnerability first disclosed.
2. 04-11-2025
   Last modifiedVulnerability information updated.

Description

Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Unfortunately, the arithmetics in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore there is no guarantee when all the writes will reach the memory. This undefined behavior was meant to be addressed by XSA-437, but the approach was not sufficient.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.