CVE-2021-28706
published 2021-11-24CVE-2021-28706: guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its…
PriorityP343high8.6CVSS 3.1
AVNACLPRNUINSCCNINAH
EPSS
2.06%
79.2th percentile
guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | xen | < xen 4.14.3+32-g9de3671772-1 (bookworm) | xen 4.14.3+32-g9de3671772-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | >= 0 < 4.14.3+32-g9de3671772-1~deb11u1 | 4.14.3+32-g9de3671772-1~deb11u1 |
| xen | xen | >= 0 < 4.14.3+32-g9de3671772-1 | 4.14.3+32-g9de3671772-1 |
| xen | xen | >= 0 < 4.14.3+32-g9de3671772-1 | 4.14.3+32-g9de3671772-1 |
| xen | xen | >= 0 < 4.14.3+32-g9de3671772-1 | 4.14.3+32-g9de3671772-1 |
| xen | xen | >= 3.2 < 4.12 | 4.12 |
| xen | xen | >= 4.14.x < unspecified | unspecified |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv8.6HIGH
vendor_debian8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x89c-76jf-xx4h: guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to incr
ghsa_unreviewed·2022-05-24
CVE-2021-28706 [HIGH] CWE-770 GHSA-x89c-76jf-xx4h: guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to incr
guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.
OSV
CVE-2021-28706: guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to incr
osv·2021-11-24·CVSS 8.6
CVE-2021-28706 [HIGH] CVE-2021-28706: guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to incr
guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.
Debian
CVE-2021-28706: xen - guests may exceed their designated memory limit When a guest is permitted to hav...
vendor_debian·2021·CVSS 8.6
CVE-2021-28706 [HIGH] CVE-2021-28706: xen - guests may exceed their designated memory limit When a guest is permitted to hav...
guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.
Scope: local
bookworm: resolved (fixed in 4.14.3+32-g9de3671772-1)
bullseye: resolved (fixed in 4.14.3+32-g9de3671772-1~deb11u1)
forky: resolved (fixed in 4.14.3+32-g9de3671772-1)
sid: resolved (fixed in 4.14.3+32-g9de3671772-1)
trixie: resolved (fixed in 4.14.3+32-g9de3671772-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7ZGWVVRI4XY2XSTBI3XEMWBXPDVX6OT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXUI4VMD52CH3T7YXAG3J2JW7ZNN3SXF/https://security.gentoo.org/glsa/202402-07https://www.debian.org/security/2021/dsa-5017https://xenbits.xenproject.org/xsa/advisory-385.txthttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7ZGWVVRI4XY2XSTBI3XEMWBXPDVX6OT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXUI4VMD52CH3T7YXAG3J2JW7ZNN3SXF/https://security.gentoo.org/glsa/202402-07https://www.debian.org/security/2021/dsa-5017https://xenbits.xenproject.org/xsa/advisory-385.txt
2021-11-24
Published