Vulnerability CVE-2021-28700

Vulnerability Name:

CVE-2021-28700 (CCN-208175)

Assigned:

2021-08-25

Published:

2021-08-25

Updated:

2022-10-28

Summary:

xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the memory limit from them is not set. This allow a domain to allocate memory beyond what an administrator originally configured.

CVSS v3 Severity:

4.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
4.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): High User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

4.4 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
3.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): High User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

6.8 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

CWE-770

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2021-28700

Source: CCN
Type: Xen Security Advisory XSA-383
xen/arm: No memory limit for dom0less domUs

Source: XF
Type: UNKNOWN
xen-cve202128700-dos(208175)

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-081f9bf5d2

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-d68ed12e46

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-4f129cc0c1

Source: GENTOO
Type: Third Party Advisory
GLSA-202208-23

Source: DEBIAN
Type: Third Party Advisory
DSA-4977

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2021-28700

Source: MISC
Type: Vendor Advisory
https://xenbits.xenproject.org/xsa/advisory-383.txt

Vulnerable Configuration:

Configuration 1:

cpe:/o:xen:xen:*:*:*:*:*:*:arm:* (Version >= 4.12.0

Configuration 2:

cpe:/o:fedoraproject:fedora:33:*:*:*:*:*:*:*

OR cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:*

OR cpe:/o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Configuration 3:

cpe:/o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:xensource:xen:4.12:*:*:*:*:*:*:*

OR cpe:/a:xensource:xen:4.13:*:*:*:*:*:*:*

OR cpe:/a:xensource:xen:4.14:*:*:*:*:*:*:*

OR cpe:/a:xensource:xen:4.12.3:*:*:*:*:*:*:*

OR cpe:/a:xensource:xen:4.12.4:*:*:*:*:*:*:*

OR cpe:/a:xensource:xen:4.13.1:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:7987	P	apache-commons-compress-1.21-150200.3.13.4 on GA media (Moderate)	2023-06-20
oval:org.opensuse.security:def:8050	P	perl-Archive-Extract-0.80-1.24 on GA media (Moderate)	2023-06-20
oval:org.opensuse.security:def:7831	P	xen-libs-4.17.0_06-150500.1.10 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:767	P	Security update for sqlite3 (Moderate)	2022-09-19
oval:org.opensuse.security:def:95375	P	Security update for MozillaThunderbird (Important) (in QA)	2022-08-01
oval:org.opensuse.security:def:3479	P	e2fsprogs-1.43.8-3.8.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3668	P	librelp0-1.2.12-3.3.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3225	P	libopus0-1.1-3.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3535	P	java-1_8_0-openjdk-1.8.0.222-27.35.2 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:94591	P	kernel-firmware-all-20220119-150400.2.3 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:94855	P	xen-libs-4.16.0_08-150400.2.12 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:95165	P	xen-4.16.0_08-150400.2.12 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:388	P	xen-libs-4.16.0_08-150400.2.12 on GA media (Moderate)	2022-06-10
oval:org.opensuse.security:def:93134	P	(Important)	2022-05-10
oval:org.opensuse.security:def:102088	P	Security update for icedtea-web (Important)	2022-04-19
oval:org.opensuse.security:def:99733	P	(Important)	2022-04-13
oval:org.opensuse.security:def:6160	P	Security update for apache2 (Important)	2022-02-16
oval:org.opensuse.security:def:111049	P	Security update for xen (Important)	2021-09-07
oval:org.opensuse.security:def:99141	P	(Important)	2021-09-03
oval:org.opensuse.security:def:76317	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:99411	P	(Important)	2021-09-02
oval:org.opensuse.security:def:9030	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:99534	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:93287	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:91996	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:42117	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:66916	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:100653	P	(Important)	2021-09-02
oval:org.opensuse.security:def:73690	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:98946	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:109424	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:92783	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:117484	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:69725	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:1627	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:60351	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:99674	P	(Important)	2021-09-02
oval:org.opensuse.security:def:9585	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:111699	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:92191	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:67249	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:101498	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:73879	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:102758	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:26117	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:92981	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:118520	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:69924	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:64568	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:99988	P	(Important)	2021-09-02
oval:org.opensuse.security:def:9784	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:100043	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:5827	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:107970	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:92385	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:69076	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:102203	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:75984	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:99139	P	(Important)	2021-09-02
oval:org.opensuse.security:def:8835	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:99335	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:34528	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:70475	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:64757	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:100324	P	(Important)	2021-09-02
oval:org.opensuse.security:def:10335	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:101304	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:96068	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:108754	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:92584	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:5104	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:69139	P	Security update for xen (Important)	2021-09-02

BACK