CVE-2021-28699 — XEN vulnerability
4 documents4 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 77.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 27
Latest updateMay 24
Description
inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this mode, a guest has two tables. As a result, guests also need to be able to retrieve the addresses that the new status tracking table can be accessed through. For 32-bit guests on x86, translation of requests has to occur because the interface structure layouts commonly differ between 32- and 64-bit. The translation of the request to obtain…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
Also affects: Debian Linux 11.0, Fedora 33, 34, 35
🔴Vulnerability Details
2GHSA▶
GHSA-gp69-2mv4-2f25: inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status↗2022-05-24
OSV▶
CVE-2021-28699: inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status↗2021-08-27
📋Vendor Advisories
1Debian▶
CVE-2021-28699: xen - inadequate grant-v2 status frames array bounds check The v2 grant table interfac...↗2021