Log in Start free

Vulnerability · Published Jan 5, 2022 · Assigned by XEN

CVE-2021-28713

Medium 6.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.4%top 70.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as "driver domains". Running PV backends in driver domains has one primary security advantage: if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. There are three affected backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch 3, CVE-2021-28713

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.15.15-1DEBIAN-CVE-2021-28713
Debian:13linux5.15.15-1DEBIAN-CVE-2021-28713
Debian:14linux5.15.15-1DEBIAN-CVE-2021-28713
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-28713
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-28713
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-28713

Affected products (as reported)

VendorProductVersions
Linux Linux see references

References