Lucene search

K
xenXen ProjectXSA-455
HistoryApr 09, 2024 - 4:29 p.m.

x86: Incorrect logic for BTC/SRSO mitigations

2024-04-0916:29:00
Xen Project
xenbits.xen.org
7
xsa-407
xsa-434
logical error
speculative return stack overflow
vulnerable systems
hardware susceptible

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

ISSUE DESCRIPTION

Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Return Stack Overflow) uses the same infrastructure, so is equally impacted.
For more details, see: <a href=“https://xenbits.xen.org/xsa/advisory-407.html”>https://xenbits.xen.org/xsa/advisory-407.html</a> <a href=“https://xenbits.xen.org/xsa/advisory-434.html”>https://xenbits.xen.org/xsa/advisory-434.html</a>

IMPACT

XSAs 407 and 434 are unmitigated, even when the patches are in place.

VULNERABLE SYSTEMS

All versions of Xen containing the XSA-407 fixes are vulnerable.
See XSAs 407 and 434 for details on which hardware is susceptible to BTC/SRSO.

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%