LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54172: x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction On hardware that supports Indirect Branch Tracking (IBT), Hyper-V VMs with ConfigVersion 9.3 or later support IBT in the guest. However, current versions of Hyper-V have a bug in that there's not an ENDBR64 instruction at the beginning of the hypercall page. Since hypercalls are made with an indirect call to the hypercall page, all hypercall attempts fail with an exception and Linux panics. A Hyper-V fix is in progress to add ENDBR64. But guard against the Linux panic by clearing X86_FEATURE_IBT if the hypercall page doesn't start with ENDBR. The VM will boot and run without IBT. If future Linux 32-bit kernels were to support IBT, additional hypercall page hackery would be needed to make IBT work for such kernels in a Hyper-V VM.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This issue can make certain Linux virtual machines on Hyper-V crash instead of booting or running normally. It happens when newer Intel branch-protection support is exposed to the guest but Hyper-V's hypercall page lacks the expected ENDBR64 instruction. The practical risk is availability loss for affected Linux guests, not documented data theft or privilege escalation.

Executive priority

Schedule remediation for affected Hyper-V Linux fleets, especially production or recovery-critical systems. The urgency is moderate because the impact is service interruption, while the evidence does not show active exploitation or confidentiality compromise.

Technical view

Linux guests on Hyper-V ConfigVersion 9.3 or later may enable IBT on supported hardware. Hypercalls use an indirect call into the Hyper-V hypercall page. If that page does not begin with ENDBR64, IBT raises an exception and Linux panics. The Linux fix clears X86_FEATURE_IBT when the hypercall page lacks ENDBR.

Likely exposure

Exposure appears limited to Linux kernel versions identified as affected when running as Hyper-V guests on IBT-capable x86 hardware with guest IBT support enabled, especially VM ConfigVersion 9.3 or later. Non-Hyper-V systems and environments without IBT exposure are not indicated as affected by the supplied sources.

Exploitation context

The sources describe a compatibility-triggered kernel panic, not an attacker-controlled exploitation path. CISA KEV status is false, and no cited source reports active exploitation. Treat this primarily as an availability and operational stability issue for impacted virtualized Linux workloads.

Researcher notes

The key condition is the mismatch between guest IBT enforcement and a Hyper-V hypercall entry point missing ENDBR64. The Linux-side resolution is defensive feature clearing when validation fails. The supplied sources do not provide CVSS, CWE mapping, exploitability details, or final Hyper-V-side fix status.

Mitigation direction

  • Apply Linux kernel updates containing the cited stable fixes.
  • Use vendor kernel packages or advisories for exact fixed versions.
  • Check Microsoft Hyper-V guidance for the pending ENDBR64 hypercall page fix.
  • Prioritize business-critical Linux guests on Hyper-V ConfigVersion 9.3 or later.
  • If updating is delayed, assess whether IBT exposure can be safely avoided.

Validation and detection

  • Inventory Linux guests running on Hyper-V and record VM configuration versions.
  • Identify hosts with hardware support for Indirect Branch Tracking.
  • Check guest kernel versions against vendor fixed-kernel advisories.
  • Review boot or crash logs for IBT-related hypercall exceptions or kernel panics.
  • Confirm updated guests boot and perform Hyper-V hypercall-dependent operations normally.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54172 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux991625f3dd2cbc4b787deb0213e2bcf8fa264b21, 991625f3dd2cbc4b787deb0213e2bcf8fa264b21, 991625f3dd2cbc4b787deb0213e2bcf8fa264b21unaffected
LinuxLinux5.18, 0, 6.1.45, 6.4.10, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.