Memory Allocation Vulnerability in Xen Hypervisor by Citrix
CVE-2021-28707

8.8HIGH

Key Information:

Vendor

Xen Project
Status
Xen
Vendor
CVE Published:
24 November 2021

What is CVE-2021-28707?

A vulnerability exists in the Xen Hypervisor that affects the operation of virtual machine guests when using Populate-on-Demand (PoD) memory allocation. The flaw arises due to misaligned page frame numbers during hypercalls, which can be exploited by guest domains to control memory assignment inappropriately. As a result, this can lead to potential instability in the host system or even service crashes. It's crucial for administrators and users to apply the available patches to mitigate these risks and protect system integrity.

Affected Version(s)

xen xen-unstable

xen 4.12.x

xen 4.15.x

References

https://xenbits.xenproject.org/xsa/advisory-388.txt
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory
https://www.debian.org/security/2021/dsa-5017
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Jan Beulich of SUSE.'}]}}}
.
CVE-2021-28707 : Memory Allocation Vulnerability in Xen Hypervisor by Citrix