5.3

CVE-2023-46839: pci: phantom functions assigned to incorrect contexts

Analyzed
AliasesALPINE-CVE-2023-46839SUSE-SU-2024:0264-1SUSE-SU-2024:0265-1
Published 20-03-2024Last modified 04-11-2025

Vulnerability summary

CVE-2023-46839 is a medium (CVSS 5.3) vulnerability in fedoraproject fedora. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.80%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 3
MGASA-2024-0047OPENSUSE-SU-2024:13648-1SUSE-SU-2024:0266-1SUSE-SU-2024:0830-1

Timeline

  1. 20-03-2024
    PublishedVulnerability first disclosed.
  2. 04-11-2025
    Last modifiedVulnerability information updated.

Description

PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.80%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.80% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse23 products
  • xen&distro=SUSE Enterprise Storage 7.1< 4.14.6_10-150300.3.63.1
  • xen&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 4.12.4_44-150100.3.101.1
  • xen&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 4.13.5_10-150200.3.86.1
  • xen&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 4.14.6_10-150300.3.63.1
  • xen&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 4.16.5_12-150400.4.46.1
Opensuse2 products
  • xen&distro=openSUSE Leap Micro 5.3< 4.16.5_12-150400.4.46.1
  • xen&distro=openSUSE Leap Micro 5.4< 4.16.5_12-150400.4.46.1
Alpine1 product
  • xen< 4.16.5-r6 | < 4.17.3-r0 | < 4.18.0-r3
Debian1 product
  • xen< 4.17.3+10-g091466ba55-1~deb12u1 | < 4.17.3+10-g091466ba55-1
Fedoraproject1 product
Ubuntu1 product
  • xenAll versions (No fix recorded)

6 vendors · 29 products

References

15 links
Show all 15 references