CVE-2023-46835

Summary

CVE-2023-46835 is a vulnerability affecting the setup of quarantine page tables. The issue lies in the assumption that the quarantine domain (dom_io) has a default address width, leading to a configuration mismatch between the operating system and the IOMMU. Specifically, on systems with less than 512GB of RAM, the IOMMU is configured with three page table levels, while the operating system initializes four levels for the quarantine domain. As a result, the last page table directory (PDE) effectively becomes a page table entry (PTE), granting devices in quarantine mode write access to a page that should be a PDE. This page table level mismatch can result in data leaks, as the sink page the device gains access to is not cleared between device assignments.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.