Log in Start free

Vulnerability · Published Apr 6, 2021 · Assigned by XEN

CVE-2021-28688

Medium 6.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.3%top 72.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable. XSA-365 was classified to affect versions back to at least 3.11.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.10.28-1DEBIAN-CVE-2021-28688
Debian:13linux5.10.28-1DEBIAN-CVE-2021-28688
Debian:14linux5.10.28-1DEBIAN-CVE-2021-28688
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-28688
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-28688
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-28688

Affected products (as reported)

VendorProductVersions
Linux Linux 3.11 – before unspecified
Linux Linux 5.11.1
Linux Linux 5.12-rc
Linux Linux 5.10.18
Linux Linux see references

References