PT-2021-6611 · Xen+1 · Xen+1

Jan Beulich · Published 2021-08-27 · Updated 2022-09-28 · CVE-2021-28699

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xen (affected versions not specified)

Description The issue is related to an inadequate grant-v2 status frames array bounds check in the Xen hypervisor. This allows a guest to potentially cause a denial of service by exploiting the vulnerability in the translation of requests for 32-bit guests on x86. The v2 grant table interface separates grant attributes from grant status, and guests need to retrieve the addresses of the new status tracking table. The translation layer has limited space, and the core function enforces array bounds to be below 8 times the specified value, which can lead to writing past the available space if enough frame numbers are needed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2022-01887

CVE-2021-28699

DSA-4977-1

OPENSUSE-SU-2021:1236-1

OPENSUSE-SU-2021:2923-1

OPENSUSE-SU-2021_1236-1

OPENSUSE-SU-2021_2923-1

SUSE-SU-2021:2922-1

SUSE-SU-2021:2923-1

SUSE-SU-2021:2924-1

SUSE-SU-2021:2925-1

SUSE-SU-2021:2943-1

SUSE-SU-2021:2955-1

SUSE-SU-2021:2957-1

Affected Products

Suse

Xen

References · 85

• https://osv.dev/vulnerability/SUSE-SU-2021:2957-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28699 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPRVHW4J4ZCPPOHZEWP5MOJT7XDGFFPJ · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2923-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4977-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZCNPSRPGFCQRYE2BI4D4Q4SCE56ANV2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-28699 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-28699 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2922-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1236-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2943-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2924-1 · Vendor Advisory
• https://debian.org/security/2021/dsa-4977 · Vendor Advisory
• https://xenbits.xenproject.org/xsa/advisory-382.txt · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-28699 · Vendor Advisory