PT-2021-6469 · Xen+1 · Xen+1
Julien Grall
·
Published
2021-09-01
·
Updated
2022-10-28
·
CVE-2021-28701
CVSS v3.1
7.8
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Xen (affected versions not specified)
Description
The issue is related to the handling of XENMAPSPACE grant table in the Xen hypervisor, where guests are allowed access to certain Xen-owned pages of memory. The majority of these pages remain allocated to a guest for its entire lifetime. However, grant table v2 status pages are de-allocated when a guest switches from v2 to v1. The hypervisor failed to enforce that no parallel request can result in the addition of a mapping of such a page to a guest, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. This could allow an attacker to access confidential data, compromise its integrity, and cause a denial of service.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Race Condition
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Suse
Xen