CVE-2021-28701 Race condition in xen
A race condition in Xen grant table handling allows guests to retain access to freed memory pages, potentially leading to information disclosure or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28701?
CVE-2021-28701 is a high-severity vulnerability in Debian Debian Linux, published on 8 Sep 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.
Weakness: CWE-362
Which versions are affected by CVE-2021-28701?
It affects 3 products.
Linux distribution packages (17)
xen SUSE:HPE Helion OpenStack 8 | All versions | 4.9.4_22-3.94.2 |
xen SUSE:Linux Enterprise Micro 5.0 | All versions | 4.13.3_04-3.37.1 |
xen SUSE:Linux Enterprise Micro 5.1 | All versions | 4.14.2_06-3.12.1 |
xen SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 4.13.3_04-3.37.1 |
xen SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 4.14.2_06-3.12.1 |
xen SUSE:Linux Enterprise Module for Server Applications 15 SP2 | All versions | 4.13.3_04-3.37.1 |
xen SUSE:Linux Enterprise Module for Server Applications 15 SP3 | All versions | 4.14.2_06-3.12.1 |
xen SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 4.9.4_22-3.94.2 |
xen SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 4.9.4_22-3.94.2 |
xen SUSE:Linux Enterprise Server 12 SP5 | All versions | 4.12.4_14-3.52.1 |
xen SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 4.9.4_22-3.94.2 |
xen SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 4.12.4_14-3.52.1 |
xen SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 4.12.4_14-3.52.1 |
xen SUSE:OpenStack Cloud 8 | All versions | 4.9.4_22-3.94.2 |
xen SUSE:OpenStack Cloud Crowbar 8 | All versions | 4.9.4_22-3.94.2 |
xen openSUSE:Leap 15.2 | All versions | 4.13.3_04-lp152.2.30.1 |
xen openSUSE:Leap 15.3 | All versions | 4.14.2_06-3.12.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Xen Xen.
How do I fix CVE-2021-28701?
Apply the vendor's patch.
Is CVE-2021-28701 being exploited?
There is no known exploitation of CVE-2021-28701 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-28701, DEBIAN-CVE-2021-28701, GHSA-423x-f92f-r5fm, SUSE-SU-2021:3140-1, SUSE-SU-2021:3140-2, SUSE-SU-2021:3141-1 and 5 more.