PT-2021-5824 · Unknown+2 · Cpu Products+2

Cristiano Giuffrida + 3 · Published 2021-06-09 · Updated 2022-08-01 · CVE-2021-26313

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xen (affected versions not specified) CPU products (affected versions not specified)

Description The issue is related to a potential speculative code store bypass in CPU products, which, in conjunction with software vulnerabilities related to speculative execution of overwritten instructions, may cause incorrect speculation and could result in data leakage. Additionally, there is a vulnerability in the Xen hypervisor related to insufficient access control to ports, which could allow an attacker to access confidential data.

Recommendations For Xen, restrict access to sensitive ports to minimize the risk of exploitation. For CPU products, consider disabling speculative execution of overwritten instructions as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Side Channel Attack

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-203

CWE-208

CWE-668

Related Identifiers

BDU:2022-00321

CVE-2021-26313

DSA-4931-1

Affected Products

Astra Linux

Cpu Products

Xen

References · 21

• 🔥 http://openwall.com/lists/oss-security/2021/06/10/1 · Exploit
• https://bdu.fstec.ru/vul/2022-00321 · Security Note
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1003 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-26313 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-26313 · Security Note
• https://osv.dev/vulnerability/DSA-4931-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26313 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26313 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26313 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-26313 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-26313 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0114SE47 · Vendor Advisory
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.1 · Note
• http://openwall.com/lists/oss-security/2021/06/10/10 · Note