CVE-2021-28702: High severity xen xapi vulnerability
PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest, then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure, including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-28702?
CVE-2021-28702 is classified as a medium severity vulnerability due to potential data integrity issues.
How do I fix CVE-2021-28702?
To fix CVE-2021-28702, upgrade to the latest version of the affected software, specifically to Xen versions 4.11.4+107-gef32c7afa2-1 or higher.
What software is affected by CVE-2021-28702?
CVE-2021-28702 affects Xen versions between 4.13.0 and 4.15.1, and various Fedora and Debian Linux distributions.
What type of devices does CVE-2021-28702 impact?
CVE-2021-28702 impacts certain PCI devices that have Reserved Memory Regions (RMRRs) assigned incorrectly.
What are the potential consequences of not addressing CVE-2021-28702?
Failure to address CVE-2021-28702 could result in security vulnerabilities, including unauthorized access or manipulation of system resources.