Improper Privilege Management Affecting xen package, versions *


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.05% (16th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Privilege Management vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIAN9-XEN-1583642
  • published9 Sept 2021
  • disclosed8 Sept 2021

Introduced: 8 Sep 2021

CVE-2021-28701  (opens in a new tab)
CWE-269  (opens in a new tab)

How to fix?

There is no fixed version for Debian:9 xen.

NVD Description

Note: Versions mentioned in the description apply only to the upstream xen package and not the xen package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.

CVSS Scores

version 3.1