Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-28701

Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a g

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
XEN

Description

Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Xen xen

  • unspecified to < 4.12unknown
  • 4.15.x to < unspecifiedaffected
  • next of xen-unstable to < unspecifiedunaffected

Xen xen

  • 4.11.xaffected

Xen xen

  • unspecified to < 4.12unknown
  • 4.12.x to < unspecifiedaffected
  • next of 4.14.x to < unspecifiedunaffected

References