CVE-2021-26932
published 2021-02-17CVE-2021-26932: An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.35%
27.2th percentile
An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and drivers/xen/gntdev.c.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 5.10.19-1 (bookworm) | linux 5.10.19-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| linux | linux_kernel | >= 0 < 5.10.19-1 | 5.10.19-1 |
| linux | linux_kernel | >= 0 < 5.10.19-1 | 5.10.19-1 |
| linux | linux_kernel | >= 0 < 5.10.19-1 | 5.10.19-1 |
| linux | linux_kernel | >= 0 < 5.10.19-1 | 5.10.19-1 |
| linux | linux_kernel | 3.2 – 5.10.16 | — |
| msrc | kernel-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-debuginfo-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-debuginfo-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-devel-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-devel-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-docs-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-docs-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-drivers-accessibility-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-drivers-accessibility-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-drivers-sound-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-drivers-sound-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-dtb-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-oprofile-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | kernel-tools-5.10.57.1-1.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | kernel-tools-5.10.57.1-1.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
BSD
FreeBSD-SA-21:06.xen: Xen grant mapping error handling issues
bsd_advisories·2021-02-24·CVSS 5.5
CVE-2021-26932 [MEDIUM] FreeBSD-SA-21:06.xen: Xen grant mapping error handling issues
FreeBSD-SA-21:06.xen Security Advisory
The FreeBSD Project
Topic: Xen grant mapping error handling issues
Category: contrib
Module: xen
Announced: 2021-02-24
Credits: See Xen XSA-361 for details
Affects: All supported versions of FreeBSD.
Corrected: 2021-02-23 00:55:14 UTC (stable/13, 13.0-STABLE)
2021-02-24 01:42:35 UTC (releng/13.0, 13.0-BETA3-p1)
2021-02-23 00:58:03 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:43:59 UTC (releng/12.2, 12.2-RELEASE-p4)
2021-02-23 00:59:23 UTC (stable/11, 11.4-STABLE)
2021-02-24 01:41:51 UTC (releng/11.4, 11.4-RELEASE-p8)
CVE Name: CVE-2021-26932
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
Xen is a type-1 hypervisor
Microsoft
An issue was discovered in the Linux kernel 3.2 through 5.10.16 as used by Xen. Grant mapping operations often occur in batch hypercalls where a number of operations are done in a single hypercall the
vendor_msrc·2021-02-09·CVSS 5.5
CVE-2021-26932 [MEDIUM] An issue was discovered in the Linux kernel 3.2 through 5.10.16 as used by Xen. Grant mapping operations often occur in batch hypercalls where a number of operations are done in a single hypercall the
An issue was discovered in the Linux kernel 3.2 through 5.10.16 as used by Xen. Grant mapping operations often occur in batch hypercalls where a number of operations are done in a single hypercall the success or failure of each one is reported to the backend driver and the backend driver then loops over the results performing follow-up actions based on the success or failure of each operation. Unfortunately when running in PV mode the Linux backend drivers mishandle this: Some errors are ignored effectively implying their success from the success of related batch elements. In other cases errors resulting from one batch element lead to further batch elements not being inspected and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backen
Debian
CVE-2021-26932: linux - An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen....
vendor_debian·2021·CVSS 5.5
CVE-2021-26932 [MEDIUM] CVE-2021-26932: linux - An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen....
An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Li
GHSA
GHSA-w8vm-5jg7-3r38: An issue was discovered in the Linux kernel 3
ghsa_unreviewed·2022-05-24
CVE-2021-26932 [MEDIUM] GHSA-w8vm-5jg7-3r38: An issue was discovered in the Linux kernel 3
An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Li
OSV
CVE-2021-26932: An issue was discovered in the Linux kernel 3
osv·2021-02-17·CVSS 5.5
CVE-2021-26932 [MEDIUM] CVE-2021-26932: An issue was discovered in the Linux kernel 3
An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Li
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://xenbits.xen.org/xsa/advisory-361.htmlhttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ebee0eab08594b2bd5db716288a4f1ae5936e9bchttps://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/https://security.netapp.com/advisory/ntap-20210326-0001/http://xenbits.xen.org/xsa/advisory-361.htmlhttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ebee0eab08594b2bd5db716288a4f1ae5936e9bchttps://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/https://security.netapp.com/advisory/ntap-20210326-0001/
2021-02-17
Published