CVE-2021-28706: High severity xen xapi vulnerability
guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-28706?
CVE-2021-28706 is considered a high-severity vulnerability due to the potential for guests to exceed their designated memory limits.
How do I fix CVE-2021-28706?
To fix CVE-2021-28706, update to the patched versions of Xen indicated in the advisory, specifically versions 4.14.6-1, 4.14.5+94-ge49571868d-1, 4.17.1+2-gb773c48e36-1, or 4.17.2+55-g0b56bed864-1.
What versions of Xen are affected by CVE-2021-28706?
CVE-2021-28706 affects Xen versions up to and including 4.12 and versions prior to 4.14.6-1.
Can CVE-2021-28706 be exploited remotely?
Yes, CVE-2021-28706 can potentially be exploited by malicious guests in a virtualized environment.
Is CVE-2021-28706 applicable to all operating systems?
No, CVE-2021-28706 specifically affects certain distributions like Debian and Fedora that utilize Xen hypervisor.