CVE-2021-28701: Race Condition
Another race in XENMAPSPACEgranttable handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-28701?
CVE-2021-28701 has a medium severity level that can lead to unauthorized access to Xen-owned memory pages.
How do I fix CVE-2021-28701?
To fix CVE-2021-28701, update to the latest version of Xen that is unaffected by this vulnerability.
What versions of Xen are affected by CVE-2021-28701?
CVE-2021-28701 affects Xen versions starting from 4.0.0 up to 4.11.4+107-gef32c7afa2-1.
Who is affected by CVE-2021-28701?
Users running affected versions of Xen, especially in Debian and Fedora environments, are at risk with CVE-2021-28701.
What impact does CVE-2021-28701 have on guest users?
CVE-2021-28701 allows guest users to access certain Xen-controlled memory pages, potentially compromising the security of the host system.