{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-28709", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "assignerShortName": "XEN", "dateUpdated": "2024-02-04T08:07:14.856683", "dateReserved": "2021-03-18T00:00:00", "datePublished": "2021-11-24T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2024-02-04T08:07:14.856683"}, "descriptions": [{"lang": "en", "value": "issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error handling in certain PoD cases has been insufficient in that in particular partial success of some operations was not properly accounted for. There are two code paths affected - page removal (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix to both issues.)"}], "affected": [{"vendor": "Xen", "product": "xen", "versions": [{"version": "4.14.x", "status": "affected"}]}, {"vendor": "Xen", "product": "xen", "versions": [{"version": "4.12.x", "status": "affected"}]}, {"vendor": "Xen", "product": "xen", "versions": [{"version": "4.15.x", "status": "affected"}]}, {"vendor": "Xen", "product": "xen", "versions": [{"version": "xen-unstable", "status": "affected"}]}, {"vendor": "Xen", "product": "xen", "versions": [{"version": "4.13.x", "status": "affected"}]}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-389.txt"}, {"name": "FEDORA-2021-03645e9807", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7ZGWVVRI4XY2XSTBI3XEMWBXPDVX6OT/"}, {"name": "DSA-5017", "tags": ["vendor-advisory"], "url": "https://www.debian.org/security/2021/dsa-5017"}, {"name": "FEDORA-2021-2b3a2de94f", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXUI4VMD52CH3T7YXAG3J2JW7ZNN3SXF/"}, {"name": "GLSA-202402-07", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202402-07"}], "credits": [{"lang": "en", "value": "{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Jan Beulich of SUSE.'}]}}}"}], "metrics": [{"other": {"type": "unknown", "content": {"description": {"description_data": [{"lang": "eng", "value": "Malicious or buggy guest kernels may be able to mount a Denial of\nService (DoS) attack affecting the entire system. Privilege escalation\nand information leaks cannot be ruled out."}]}}}}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "unknown"}]}]}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*", "matchCriteriaId": "3EFBF066-D1E3-4065-A6F6-7E1103E1818D", "versionEndIncluding": "4.12.4", "versionStartIncluding": "3.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*", "matchCriteriaId": "50E23003-9CFD-4E42-8C44-0E6CCF123EEC", "versionEndIncluding": "4.13.4", "versionStartIncluding": "4.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*", "matchCriteriaId": "855A8245-709D-4316-A405-C6A6976AC8F9", "versionEndIncluding": "4.14.3", "versionStartIncluding": "4.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.15.0:*:*:*:*:*:x86:*", "matchCriteriaId": "C3BFD203-8E25-46AF-AF43-DAFB86BDFE0D", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.15.1:*:*:*:*:*:x86:*", "matchCriteriaId": "B913BAA9-3E44-4073-AD4A-2D5B02A5ACBB", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*", "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error handling in certain PoD cases has been insufficient in that in particular partial success of some operations was not properly accounted for. There are two code paths affected - page removal (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix to both issues.)"}, {"lang": "es", "value": "Problemas con actualizaciones P2M parcialmente exitosas en x86 [Este registro de informaci\u00f3n CNA se relaciona con m\u00faltiples CVEs; el texto explica qu\u00e9 aspectos/vulnerabilidades corresponden a cada CVE]. Los hu\u00e9spedes x86 HVM y PVH pueden iniciarse en modo populate-on-demand (PoD), para proporcionar una manera de que m\u00e1s tarde les es asignada f\u00e1cilmente m\u00e1s memoria. A los hu\u00e9spedes les es permitido controlar determinados aspectos P2M de p\u00e1ginas individuales por medio de hypercalls. Estas hypercalls pueden actuar sobre rangos de p\u00e1ginas especificados por medio de \u00f3rdenes de p\u00e1ginas (resultando en un n\u00famero de p\u00e1ginas de potencia 2). En algunos casos, el hipervisor realiza las peticiones dividi\u00e9ndolas en trozos m\u00e1s peque\u00f1os. El manejo de errores en algunos casos de PdD ha sido insuficiente, ya que, en particular, el \u00e9xito parcial de algunas operaciones no se contabiliz\u00f3 apropiadamente. Se presentan dos rutas de c\u00f3digo afectadas: la eliminaci\u00f3n de p\u00e1ginas (CVE-2021-28705) y la inserci\u00f3n de nuevas p\u00e1ginas (CVE-2021-28709). (Proporcionamos un parche que combina la correcci\u00f3n de ambos problemas)"}], "id": "CVE-2021-28709", "lastModified": "2024-02-04T08:15:09.180", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-11-24T02:15:06.730", "references": [{"source": "security@xen.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7ZGWVVRI4XY2XSTBI3XEMWBXPDVX6OT/"}, {"source": "security@xen.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXUI4VMD52CH3T7YXAG3J2JW7ZNN3SXF/"}, {"source": "security@xen.org", "url": "https://security.gentoo.org/glsa/202402-07"}, {"source": "security@xen.org", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2021/dsa-5017"}, {"source": "security@xen.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://xenbits.xenproject.org/xsa/advisory-389.txt"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-755"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}