CVE-2021-28705
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error handling in certain PoD cases has been insufficient in that in particular partial success of some operations was not properly accounted for. There are two code paths affected - page removal (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix to both issues.)
problemas con actualizaciones P2M parcialmente con éxito en x86 [Este registro de información CNA se relaciona con múltiples CVEs; el texto explica qué aspectos/vulnerabilidades corresponden a cada CVE]. Los huéspedes x86 HVM y PVH pueden iniciarse en modo populate-on-demand (PoD), para proporcionar una forma de que más tarde les sea asignada fácilmente más memoria. A los huéspedes les es permitido controlar determinados aspectos P2M de páginas individuales por medio de hypercalls. Estas hypercalls pueden actuar sobre rangos de páginas especificados por medio de órdenes de páginas (resultando en un número de páginas de potencia 2). En algunos casos, el hipervisor realiza las peticiones dividiéndolas en trozos más pequeños. El manejo de errores en algunos casos de PdD ha sido insuficiente, ya que, en particular, el éxito parcial de algunas operaciones no se contabilizó apropiadamente. Se presentan dos rutas de código afectadas: la eliminación de páginas (CVE-2021-28705) y la inserción de nuevas páginas (CVE-2021-28709). (Proporcionamos un parche que combina la corrección de ambos problemas)
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-03-18 CVE Reserved
- 2021-11-24 CVE Published
- 2024-02-08 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-755: Improper Handling of Exceptional Conditions
CAPEC
References (5)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://xenbits.xenproject.org/xsa/advisory-389.txt | 2024-02-04 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | >= 3.4.0 <= 4.12.4 Search vendor "Xen" for product "Xen" and version " >= 3.4.0 <= 4.12.4" | x86 |
Affected
| ||||||
Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | >= 4.13.0 <= 4.13.4 Search vendor "Xen" for product "Xen" and version " >= 4.13.0 <= 4.13.4" | x86 |
Affected
| ||||||
Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | >= 4.14.0 <= 4.14.3 Search vendor "Xen" for product "Xen" and version " >= 4.14.0 <= 4.14.3" | x86 |
Affected
| ||||||
Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | 4.15.0 Search vendor "Xen" for product "Xen" and version "4.15.0" | x86 |
Affected
| ||||||
Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | 4.15.1 Search vendor "Xen" for product "Xen" and version "4.15.1" | x86 |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 34 Search vendor "Fedoraproject" for product "Fedora" and version "34" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 35 Search vendor "Fedoraproject" for product "Fedora" and version "35" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
|