CVE-2021-26933: Medium severity xen xapi vulnerability
An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no guarantee when all the writes will reach the memory.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-26933?
CVE-2021-26933 has a high severity rating due to the potential for memory access issues affecting guest control.
How do I fix CVE-2021-26933?
To fix CVE-2021-26933, update Xen to a version that includes the relevant patches such as 4.11.4+107-gef32c7afa2-1 or later.
Which versions of Xen are affected by CVE-2021-26933?
CVE-2021-26933 affects Xen versions 4.9 through 4.14.x on Arm architecture.
How does CVE-2021-26933 impact system security?
CVE-2021-26933 can lead to inconsistent memory writes, which may compromise the integrity of the virtualized environment.
Is CVE-2021-26933 specific to any operating system?
CVE-2021-26933 impacts systems running Xen hypervisor on various Linux distributions, including Fedora and Debian.