CVE-2023-46839
pci: phantom functions assigned to incorrect contexts
PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests.
Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
pci: phantom functions assigned to incorrect contexts
PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests.
Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.
- Record
CVE-2023-46839- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
EUVDEUVD-2023-51005
PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests.
Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.
- Record
EUVD-2023-51005- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8f65-fxmq-vvpx
PCI devices can make use of a functionality called phantom functions, that when enabled allows...
PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests.
Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.
- Record
GHSA-8f65-fxmq-vvpx- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
NVD
PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests.
Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.
- Record
CVE-2023-46839- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVALPINE-CVE-2023-46839
PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests.
Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.
- Record
ALPINE-CVE-2023-46839- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSV
PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests.
Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.
- Record
CVE-2023-46839- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2023-46839
PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.
- Record
DEBIAN-CVE-2023-46839- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-46839
PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.
- Record
UBUNTU-CVE-2023-46839- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2024-0047 No score
Updated xen, qemu and libvirt packages fix security vulnerabilities
This update fixes several security issues and also improves stability.
- Record
MGASA-2024-0047- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13648-1 No score
xen-4.18.0_06-1.1 on GA media
These are all security issues fixed in the xen-4.18.0_06-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13648-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0264-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts (XSA-449) (bsc#1218851)
- Record
SUSE-SU-2024:0264-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0265-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts (XSA-449) (bsc#1218851)
- Record
SUSE-SU-2024:0265-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0266-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts (XSA-449) (bsc#1218851)
- CVE-2023-46840: Fixed VT-d: Failure to quarantine devices in !HVM builds (XSA-450) (bsc#1219080)
- Record
SUSE-SU-2024:0266-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0268-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts (XSA-449) (bsc#1218851)
- Record
SUSE-SU-2024:0268-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0269-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts (XSA-449) (bsc#1218851)
- Record
SUSE-SU-2024:0269-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0270-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts (XSA-449) (bsc#1218851)
- Record
SUSE-SU-2024:0270-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0830-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2023-46839: Fixed memory access through PCI device with phantom functions (XSA-449) (bsc#1218851).
- CVE-2023-46840: Fixed Failure to quarantine devices in !HVM builds (XSA-450) (bsc#1219080).
- CVE-2023-46841: Fixed shadow stack vs exceptions from emulation stubs (XSA-451) (bsc#1219885).
- Record
SUSE-SU-2024:0830-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xenAlpine:v3.16 |
before 4.16.5-r6 | 4.16.5-r6 |
xenAlpine:v3.17 |
before 4.16.5-r6 | 4.16.5-r6 |
xenAlpine:v3.18 |
before 4.17.3-r0 | 4.17.3-r0 |
xenAlpine:v3.19 |
before 4.18.0-r3 | 4.18.0-r3 |
xenAlpine:v3.20 |
before 4.18.0-r3 | 4.18.0-r3 |
xenAlpine:v3.21 |
before 4.18.0-r3 | 4.18.0-r3 |
xenAlpine:v3.22 |
before 4.18.0-r3 | 4.18.0-r3 |
xenAlpine:v3.23 |
before 4.18.0-r3 | 4.18.0-r3 |
xenAlpine:v3.24 |
before 4.18.0-r3 | 4.18.0-r3 |
xenDebian:12 |
before 4.17.3+10-g091466ba55-1~deb12u1, plus listed versions 4.17.1+2-gb773c48e36-14.17.2+55-g0b56bed864-14.17.2+76-ge1f9cb16e2-14.17.2+76-ge1f9cb16e2-1~deb12u14.17.2-1 |
4.17.3+10-g091466ba55-1~deb12u1 |
Show 47 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xenDebian:13 |
before 4.17.3+10-g091466ba55-1 | 4.17.3+10-g091466ba55-1 |
xenDebian:14 |
before 4.17.3+10-g091466ba55-1 | 4.17.3+10-g091466ba55-1 |
qemuMageia:9 From an advisory covering 4 CVEs |
before 7.2.9-1.mga9 | 7.2.9-1.mga9 |
libvirtMageia:9 From an advisory covering 4 CVEs |
before 9.6.0-1.mga9 | 9.6.0-1.mga9 |
xenMageia:9 From an advisory covering 4 CVEs |
before 4.17.3-1.mga9 | 4.17.3-1.mga9 |
xenSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 4.14.6_10-150300.3.63.1 | 4.14.6_10-150300.3.63.1 |
xenSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 4.14.6_10-150300.3.63.1 | 4.14.6_10-150300.3.63.1 |
xenSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 4.14.6_10-150300.3.63.1 | 4.14.6_10-150300.3.63.1 |
xenSUSE:Linux Enterprise Micro 5.1 |
before 4.14.6_10-150300.3.63.1 | 4.14.6_10-150300.3.63.1 |
xenSUSE:Linux Enterprise Micro 5.2 |
before 4.14.6_10-150300.3.63.1 | 4.14.6_10-150300.3.63.1 |
xenSUSE:Enterprise Storage 7.1 |
before 4.14.6_10-150300.3.63.1 | 4.14.6_10-150300.3.63.1 |
xenSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 4.12.4_44-3.103.1 | 4.12.4_44-3.103.1 |
xenSUSE:Linux Enterprise Server 12 SP5 |
before 4.12.4_44-3.103.1 | 4.12.4_44-3.103.1 |
xenSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 4.12.4_44-3.103.1 | 4.12.4_44-3.103.1 |
xenSUSE:Linux Enterprise Micro 5.5 From an advisory covering 2 CVEs |
before 4.17.3_04-150500.3.21.1 | 4.17.3_04-150500.3.21.1 |
xenSUSE:Linux Enterprise Module for Basesystem 15 SP5 From an advisory covering 2 CVEs |
before 4.17.3_04-150500.3.21.1 | 4.17.3_04-150500.3.21.1 |
xenSUSE:Linux Enterprise Module for Server Applications 15 SP5 From an advisory covering 2 CVEs |
before 4.17.3_04-150500.3.21.1 | 4.17.3_04-150500.3.21.1 |
xenopenSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 4.17.3_04-150500.3.21.1 | 4.17.3_04-150500.3.21.1 |
xenSUSE:Linux Enterprise Micro 5.3 |
before 4.16.5_12-150400.4.46.1 | 4.16.5_12-150400.4.46.1 |
xenSUSE:Linux Enterprise Micro 5.4 |
before 4.16.5_12-150400.4.46.1 | 4.16.5_12-150400.4.46.1 |
xenSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 4.16.5_12-150400.4.46.1 | 4.16.5_12-150400.4.46.1 |
xenSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 4.16.5_12-150400.4.46.1 | 4.16.5_12-150400.4.46.1 |
xenSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 4.16.5_12-150400.4.46.1 | 4.16.5_12-150400.4.46.1 |
xenSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 4.16.5_12-150400.4.46.1 | 4.16.5_12-150400.4.46.1 |
xenSUSE:Manager Proxy 4.3 |
before 4.16.5_12-150400.4.46.1 | 4.16.5_12-150400.4.46.1 |
xenSUSE:Manager Server 4.3 |
before 4.16.5_12-150400.4.46.1 | 4.16.5_12-150400.4.46.1 |
xenopenSUSE:Leap Micro 5.3 |
before 4.16.5_12-150400.4.46.1 | 4.16.5_12-150400.4.46.1 |
xenopenSUSE:Leap Micro 5.4 |
before 4.16.5_12-150400.4.46.1 | 4.16.5_12-150400.4.46.1 |
xenSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 4.12.4_44-150100.3.101.1 | 4.12.4_44-150100.3.101.1 |
xenSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 4.12.4_44-150100.3.101.1 | 4.12.4_44-150100.3.101.1 |
xenSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 4.12.4_44-150100.3.101.1 | 4.12.4_44-150100.3.101.1 |
xenSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 4.13.5_10-150200.3.86.1 | 4.13.5_10-150200.3.86.1 |
xenSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 4.13.5_10-150200.3.86.1 | 4.13.5_10-150200.3.86.1 |
xenSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 4.13.5_10-150200.3.86.1 | 4.13.5_10-150200.3.86.1 |
xenSUSE:Linux Enterprise Micro 5.5 From an advisory covering 3 CVEs |
before 4.17.3_06-150500.3.24.1 | 4.17.3_06-150500.3.24.1 |
xenSUSE:Linux Enterprise Module for Basesystem 15 SP5 From an advisory covering 3 CVEs |
before 4.17.3_06-150500.3.24.1 | 4.17.3_06-150500.3.24.1 |
xenSUSE:Linux Enterprise Module for Server Applications 15 SP5 From an advisory covering 3 CVEs |
before 4.17.3_06-150500.3.24.1 | 4.17.3_06-150500.3.24.1 |
xenopenSUSE:Leap 15.5 From an advisory covering 3 CVEs |
before 4.17.3_06-150500.3.24.1 | 4.17.3_06-150500.3.24.1 |
xenUbuntu:16.04:LTS |
All versions, plus listed versions 4.5.1-0ubuntu14.5.1-0ubuntu24.6.0-1ubuntu14.6.0-1ubuntu24.6.0-1ubuntu4 Show 7 moreShow less4.6.0-1ubuntu4.14.6.0-1ubuntu4.24.6.0-1ubuntu4.34.6.5-0ubuntu14.6.5-0ubuntu1.14.6.5-0ubuntu1.24.6.5-0ubuntu1.4 |
None known |
xenUbuntu:18.04:LTS |
All versions, plus listed versions 4.9.0-0ubuntu34.9.0-0ubuntu44.9.2-0ubuntu1 |
None known |
xenUbuntu:20.04:LTS |
All versions, plus listed versions 4.9.2-0ubuntu24.9.2-0ubuntu64.9.2-0ubuntu74.11.3+24-g14b62ab3e5-1ubuntu14.11.3+24-g14b62ab3e5-1ubuntu24.11.3+24-g14b62ab3e5-1ubuntu2.24.11.3+24-g14b62ab3e5-1ubuntu2.3 |
None known |
xenUbuntu:22.04:LTS |
All versions, plus listed versions 4.11.4+24-gddaaccbbab-1ubuntu24.16.0-1~ubuntu24.16.0-1~ubuntu2.1 |
None known |
xenUbuntu:24.04:LTS |
All versions, plus listed versions 4.17.2-14.17.2+55-g0b56bed864-14.17.2+76-ge1f9cb16e2-14.17.2+76-ge1f9cb16e2-1ubuntu14.17.3+10-g091466ba55-14.17.3+10-g091466ba55-1.1ubuntu24.17.3+10-g091466ba55-1.1ubuntu3 |
None known |
xenUbuntu:25.10 |
All versions, plus listed versions 4.20.0-1ubuntu14.20.0+68-g35cb38b222-1 |
None known |
xenUbuntu:26.10 |
All versions, plus listed versions 4.20.2+7-g1badcf5035-2build24.20.2+37-g61ff35323e-1ubuntu14.20.3+127-gc42374a105-1 |
None known |
xenUbuntu:26.04:LTS |
All versions, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+7-g1badcf5035-24.20.2+7-g1badcf5035-2build2 |
None known |
xenopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 4.18.0_06-1.1 | 4.18.0_06-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-46839 is a medium vulnerability (CVSS 5.3) in Fedoraproject Fedora, published January 30, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in xen 4.16.5-r6.
References
xenbits.xenproject.org/xsa/advisory-449.html
lists.fedoraproject.org/archives/list/[email protected]/message/XLL6SQ6IKFYXLYWITYZCRV5IBRK5G35R
xenbits.xen.org/xsa/advisory-449.html
nvd.nist.gov/vuln/detail/CVE-2023-46839
github.com/advisories/GHSA-8f65-fxmq-vvpx
security.alpinelinux.org/vuln/CVE-2023-46839
Show 21 moreShow less
security-tracker.debian.org/tracker/CVE-2023-46839
advisories.mageia.org/MGASA-2024-0047.html
bugs.mageia.org/show_bug.cgi?id=32332
suse.com/support/update/announcement/2024/suse-su-20240264-1
bugzilla.suse.com/1218851
ubuntu.com/security/CVE-2023-46839
cve.org/CVERecord?id=CVE-2023-46839