Vulnerability · Published Aug 27, 2021 · Assigned by XEN
CVE-2021-28695
Medium 6.8
In plain English
A medium-severity security flaw in xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | xen | 4.15.0-r2 | ALPINE-CVE-2021-28695 |
| Alpine:v3.21 | xen | 4.15.0-r2 | ALPINE-CVE-2021-28695 |
| Alpine:v3.22 | xen | 4.15.0-r2 | ALPINE-CVE-2021-28695 |
| Alpine:v3.23 | xen | 4.15.0-r2 | ALPINE-CVE-2021-28695 |
| Alpine:v3.24 | xen | 4.15.0-r2 | ALPINE-CVE-2021-28695 |
| Debian:12 | xen | 4.14.3-1 | DEBIAN-CVE-2021-28695 |
| Debian:13 | xen | 4.14.3-1 | DEBIAN-CVE-2021-28695 |
| Debian:14 | xen | 4.14.3-1 | DEBIAN-CVE-2021-28695 |
| Ubuntu:22.04:LTS | xen | no fix listed | UBUNTU-CVE-2021-28695 |
| Ubuntu:24.04:LTS | xen | no fix listed | UBUNTU-CVE-2021-28695 |
| Ubuntu:25.10 | xen | no fix listed | UBUNTU-CVE-2021-28695 |
| Ubuntu:26.04:LTS | xen | no fix listed | UBUNTU-CVE-2021-28695 |
| Ubuntu:26.10 | xen | no fix listed | UBUNTU-CVE-2021-28695 |
Affected products (as reported)
References
- https://xenbits.xenproject.org/xsa/advisory-378.txt x_refsource_MISC
- [oss-security] 20210901 Xen Security Advisory 378 v3 (CVE-2021-28694,CVE-2021-28695,CVE-2021-28696) - IOMMU page mapping issues on x86 mailing-list, x_refsource_MLIST
- [oss-security] 20210901 Re: Xen Security Advisory 378 v3 (CVE-2021-28694,CVE-2021-28695,CVE-2021-28696) - IOMMU page mapping issues on x86 mailing-list, x_refsource_MLIST
- [oss-security] 20210901 Re: Xen Security Advisory 378 v3 (CVE-2021-28694,CVE-2021-28695,CVE-2021-28696) - IOMMU page mapping issues on x86 mailing-list, x_refsource_MLIST
- FEDORA-2021-4f129cc0c1 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-d68ed12e46 vendor-advisory, x_refsource_FEDORA
- DSA-4977 vendor-advisory, x_refsource_DEBIAN
- FEDORA-2021-081f9bf5d2 vendor-advisory, x_refsource_FEDORA
- GLSA-202208-23 vendor-advisory, x_refsource_GENTOO