CVE-2021-28706 Integer overflow in xen
A guest VM can exceed its memory limit via an integer overflow in hypercall processing, potentially leading to resource exhaustion or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28706?
CVE-2021-28706 is a high-severity vulnerability in Debian Debian Linux, published on 24 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.
Weakness: CWE-770
Which versions are affected by CVE-2021-28706?
It affects 3 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Xen Xen.
How do I fix CVE-2021-28706?
Apply the vendor's patch.
Is CVE-2021-28706 being exploited?
There is no known exploitation of CVE-2021-28706 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-28706, DEBIAN-CVE-2021-28706, GHSA-x89c-76jf-xx4h, UBUNTU-CVE-2021-28706.