CVE-2023-46839: medium-severity vulnerability in Xen
pci: phantom functions assigned to incorrect contexts
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
When a PCI device uses phantom functions (a feature to generate more requests), the system may fail to properly set up security isolation for these phantom functions. This can result in some phantom functions being accessible from the wrong virtual machine or domain, potentially allowing unauthorized access.
PCI phantom functions require IOMMU context configuration for proper isolation. When device assignment occurs and IOMMU context setup fails, the primary device may be assigned to one domain while phantom functions are assigned to another, breaking the intended isolation boundary. This allows cross-domain access to device functionality.
In the same product, most dangerous first.