CVE-2021-28697
published 2021-08-27CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.26%
17.8th percentile
grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | xen | < xen 4.14.3-1 (bookworm) | xen 4.14.3-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | >= 0 < 4.14.3-1~deb11u1 | 4.14.3-1~deb11u1 |
| xen | xen | >= 0 < 4.14.3-1 | 4.14.3-1 |
| xen | xen | >= 0 < 4.14.3-1 | 4.14.3-1 |
| xen | xen | >= 0 < 4.14.3-1 | 4.14.3-1 |
| xen | xen | 4.0.0 – 4.15.0 | — |
| xen | xen | >= 4.11.x < unspecified | unspecified |
| xen | xen | >= 4.13.x < unspecified | unspecified |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2h72-2hx7-mmcq: grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory
ghsa_unreviewed·2022-05-24
CVE-2021-28697 [HIGH] CWE-269 GHSA-2h72-2hx7-mmcq: grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory
grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes.
OSV
CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory
osv·2021-08-27·CVSS 7.8
CVE-2021-28697 [HIGH] CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory
grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes.
Debian
CVE-2021-28697: xen - grant table v2 status pages may remain accessible after de-allocation Guest get ...
vendor_debian·2021·CVSS 7.8
CVE-2021-28697 [HIGH] CVE-2021-28697: xen - grant table v2 status pages may remain accessible after de-allocation Guest get ...
grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes.
Scope: local
bookworm: resolved (fixed in
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VQCFAPBNGBBAOMJZG6QBREOG5IIDZID/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZCNPSRPGFCQRYE2BI4D4Q4SCE56ANV2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPRVHW4J4ZCPPOHZEWP5MOJT7XDGFFPJ/https://security.gentoo.org/glsa/202208-23https://www.debian.org/security/2021/dsa-4977https://xenbits.xenproject.org/xsa/advisory-379.txthttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VQCFAPBNGBBAOMJZG6QBREOG5IIDZID/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZCNPSRPGFCQRYE2BI4D4Q4SCE56ANV2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPRVHW4J4ZCPPOHZEWP5MOJT7XDGFFPJ/https://security.gentoo.org/glsa/202208-23https://www.debian.org/security/2021/dsa-4977https://xenbits.xenproject.org/xsa/advisory-379.txt
2021-08-27
Published