CVE-2021-28699XEN vulnerability

4 documents4 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 77.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedAug 27
Latest updateMay 24

Description

inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this mode, a guest has two tables. As a result, guests also need to be able to retrieve the addresses that the new status tracking table can be accessed through. For 32-bit guests on x86, translation of requests has to occur because the interface structure layouts commonly differ between 32- and 64-bit. The translation of the request to obtain

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

CVEListV5xen/xen4.11.xunspecified
debiandebian/xen< xen 4.14.3-1 (bookworm)
Debianxen/xen< 4.14.3-1~deb11u1+3
NVDxen/xen

Also affects: Debian Linux 11.0, Fedora 33, 34, 35

🔴Vulnerability Details

2
GHSA
GHSA-gp69-2mv4-2f25: inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status2022-05-24
OSV
CVE-2021-28699: inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status2021-08-27

📋Vendor Advisories

1
Debian
CVE-2021-28699: xen - inadequate grant-v2 status frames array bounds check The v2 grant table interfac...2021