CVE-2021-28700 Denial of service in xen
An attacker with control over a dom0less domain can exhaust system memory by bypassing configured limits, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28700?
CVE-2021-28700 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 27 Aug 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the memory limit from them is not set. This allow a domain to allocate memory beyond what an administrator originally configured.
Weakness: CWE-770
Which versions are affected by CVE-2021-28700?
It affects 3 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Xen Xen.
How do I fix CVE-2021-28700?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-28700 being exploited?
There is no known exploitation of CVE-2021-28700 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-28700, DEBIAN-CVE-2021-28700, GHSA-whw9-2rv6-633x, UBUNTU-CVE-2021-28700.