Memory Update Flaws in Xen Hypervisor Affecting x86 Platforms
CVE-2021-28705

7.8HIGH

Key Information:

Vendor

Xen Project
Status
Xen
Vendor
CVE Published:
24 November 2021

What is CVE-2021-28705?

The vulnerability involves insufficient error handling during partially successful page memory-type (P2M) updates in x86 HVM and PVH guests using the Xen Hypervisor. When operating in populate-on-demand (PoD) mode, the hypervisor allows guests to control certain aspects of memory management through hypercalls. In some scenarios, this can lead to improper handling of requests—specifically during page removal and insertion operations—allowing for potential memory inconsistencies and exploitation by malicious actors. A single patch has been provided that addresses both this and a related issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

xen 4.14.x

xen 4.12.x

xen 4.15.x

References

https://xenbits.xenproject.org/xsa/advisory-389.txt
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory
https://www.debian.org/security/2021/dsa-5017
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Jan Beulich of SUSE.'}]}}}
JSON
.