How severe is CVE-2023-46836?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 4.7 out of 10.

What type of vulnerability is CVE-2023-46836?

This is classified as NVD-CWE-Other, which is a common weakness in software security.

CVE-2023-46836 - MEDIUM Severity | CVSS 4.7

Vulnerability Description

The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations are not active together by default. Therefore, there is a race condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack against Xen.

Related Vulnerabilities

CVE-2016-0623

MEDIUM

CVSS:4.7(Medium)

Unspecified vulnerability in Oracle Sun Solaris 11.3 allows remote attackers to affect integrity via vectors related to the Automated Installer sub-component.

NVD-CWE-Other2016

CVE-2016-0642

MEDIUM

CVSS:4.7(Medium)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors related to Federated.

NVD-CWE-Other2016

CVE-2016-0655

MEDIUM

CVSS:4.7(Medium)

Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier and MariaDB 10.0.x before 10.0.25 and 10.1.x before 10.1.14 allows local users to affect availability via vectors re...

NVD-CWE-Other2016

CVE-2016-0661

MEDIUM

CVSS:4.7(Medium)

Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Options.

NVD-CWE-Other2016

CVE-2016-0663

MEDIUM

CVSS:4.7(Medium)

Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to Performance Schema.

NVD-CWE-Other2016

CVE-2016-0676

MEDIUM

CVSS:4.7(Medium)

Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect availability via vectors related to the kernel.

NVD-CWE-Other2016