CVE-2023-46840: 
NixOS vulnerability analysis and mitigation

CVE-2023-46840 is a vulnerability in Xen's VT-d functionality discovered by Teddy Astie of Vates. The issue stems from incorrect placement of a preprocessor directive in source code that affects logic when support for HVM guests is compiled out of Xen. This vulnerability affects Xen versions 4.17 and onwards, specifically on x86 platforms with Intel-compatible VT-d IOMMU, when CONFIG_HVM is disabled at build time (Xen Advisory).

The vulnerability occurs due to improper preprocessing directive placement in the source code, which causes unintended behavior when HVM guest support is compiled out. This specifically affects the VT-d (Intel's Virtualization Technology for Directed I/O) functionality in Xen. The issue is only present when CONFIG_HVM is disabled during build time, though most deployments typically have this enabled by default (Xen Advisory).

When a device is removed from a domain, it is not properly quarantined and retains its access to the domain to which it was previously assigned. This impact is particularly relevant for systems where PCI devices are passed through to untrusted or semi-trusted guests (Xen Advisory).

The vulnerability affects systems running Xen 4.17 and later versions on x86 platforms with Intel-compatible VT-d IOMMU. Systems are only vulnerable when CONFIG_HVM is disabled at build time and when PCI devices are passed through to untrusted or semi-trusted guests. Systems that do not assign PCI devices to untrusted guests are not vulnerable (Xen Advisory).

There is no mitigation available for this vulnerability. The only resolution is to apply the security patch provided in the advisory. The patch has been prepared to apply to stable branches, and downstream users are encouraged to update to the tip of the stable branch before applying these patches (Xen Advisory).