CVE-2021-28709

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error handling in certain PoD cases has been insufficient in that in particular partial success of some operations was not properly accounted for. There are two code paths affected - page removal (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix to both issues.)

Problemas con actualizaciones P2M parcialmente exitosas en x86 [Este registro de información CNA se relaciona con múltiples CVEs; el texto explica qué aspectos/vulnerabilidades corresponden a cada CVE]. Los huéspedes x86 HVM y PVH pueden iniciarse en modo populate-on-demand (PoD), para proporcionar una manera de que más tarde les es asignada fácilmente más memoria. A los huéspedes les es permitido controlar determinados aspectos P2M de páginas individuales por medio de hypercalls. Estas hypercalls pueden actuar sobre rangos de páginas especificados por medio de órdenes de páginas (resultando en un número de páginas de potencia 2). En algunos casos, el hipervisor realiza las peticiones dividiéndolas en trozos más pequeños. El manejo de errores en algunos casos de PdD ha sido insuficiente, ya que, en particular, el éxito parcial de algunas operaciones no se contabilizó apropiadamente. Se presentan dos rutas de código afectadas: la eliminación de páginas (CVE-2021-28705) y la inserción de nuevas páginas (CVE-2021-28709). (Proporcionamos un parche que combina la corrección de ambos problemas)

*Credits: This issue was discovered by Jan Beulich of SUSE.

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-03-18 CVE Reserved
2021-11-24 CVE Published
2024-02-08 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-755: Improper Handling of Exceptional Conditions

CAPEC

References (5)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://xenbits.xenproject.org/xsa/advisory-389.txt	2024-02-04

URL	Date	SRC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7ZGWVVRI4XY2XSTBI3XEMWBXPDVX6OT	2024-02-04
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXUI4VMD52CH3T7YXAG3J2JW7ZNN3SXF	2024-02-04
https://security.gentoo.org/glsa/202402-07	2024-02-04
https://www.debian.org/security/2021/dsa-5017	2024-02-04

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				>= 3.4.0 <= 4.12.4 Search vendor "Xen" for product "Xen" and version " >= 3.4.0 <= 4.12.4"		x86		Affected
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				>= 4.13.0 <= 4.13.4 Search vendor "Xen" for product "Xen" and version " >= 4.13.0 <= 4.13.4"		x86		Affected
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				>= 4.14.0 <= 4.14.3 Search vendor "Xen" for product "Xen" and version " >= 4.14.0 <= 4.14.3"		x86		Affected
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				4.15.0 Search vendor "Xen" for product "Xen" and version "4.15.0"		x86		Affected
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				4.15.1 Search vendor "Xen" for product "Xen" and version "4.15.1"		x86		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				34 Search vendor "Fedoraproject" for product "Fedora" and version "34"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				35 Search vendor "Fedoraproject" for product "Fedora" and version "35"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0"		-		Affected