CVE-2023-46836

The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative
Return Stack Overflow) are not IRQ-safe. It was believed that the
mitigations always operated in contexts with IRQs disabled. However, the
original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts
enabled on two entry paths; one unconditionally, and one conditionally on
whether XPTI was active. As BTC/SRSO and Meltdown affect different CPU
vendors, the mitigations are not active together by default. Therefore,
there is a race condition whereby a malicious PV guest can bypass BTC/SRSO
protections and launch a BTC/SRSO attack against Xen.

Notes