Read the docs
TI-2021-09775 Aliases CVE-2021-28709GHSA-5rjh-29pm-3mx4

Improper handling of exceptional conditions in xen

Priority LOW 34CWE-755Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error handling in certain PoD cases has been insufficient in that in particular partial success of some operations was not properly accounted for. There are two code paths affected - page removal (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix to both issues.)

Why it matters now

EPSS 0.00366 30th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Xenxen4.14.x—No fix listedCNA
Xenxen4.12.x—No fix listedCNA
Xenxen4.15.x—No fix listedCNA
Xenxenxen-unstable—No fix listedCNA
Xenxen4.13.x—No fix listedCNA
  • xen VendorXen Affected 4.14.x Fixed in — No fix listed CNA
  • xen VendorXen Affected 4.12.x Fixed in — No fix listed CNA
  • xen VendorXen Affected 4.15.x Fixed in — No fix listed CNA
  • xen VendorXen Affected xen-unstable Fixed in — No fix listed CNA
  • xen VendorXen Affected 4.13.x Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*3.4.0 – 4.12.4; 4.13.0 – 4.13.4; 4.14.0 – 4.14.3VulnerableXen
cpe:2.3:o:xen:xen:4.15.0:*:*:*:*:*:x86:*4.15.0VulnerableXen
cpe:2.3:o:xen:xen:4.15.1:*:*:*:*:*:x86:*4.15.1VulnerableXen
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:* Versions 3.4.0 – 4.12.4; 4.13.0 – 4.13.4; 4.14.0 – 4.14.3 Vulnerable ·Xen
  • cpe:2.3:o:xen:xen:4.15.0:*:*:*:*:*:x86:* Versions 4.15.0 Vulnerable ·Xen
  • cpe:2.3:o:xen:xen:4.15.1:*:*:*:*:*:x86:* Versions 4.15.1 Vulnerable ·Xen
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    xen — FEDORA-2021-03645e9807

    7 records Highest priority Priority MEDIUM 2 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2021-09772 Resource allocation without limits in xenPriority MEDIUM 42
    • TI-2021-09774 PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs…Priority MEDIUM 40
    • TI-2021-09776 Improper privilege management in xenPriority LOW 38
    Show all 7 records → Advisory →
  • Advisory ·

    xen — FEDORA-2021-2b3a2de94f

    6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2021-09772 Resource allocation without limits in xenPriority MEDIUM 42
    • TI-2021-09774 PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs…Priority MEDIUM 40
    • TI-2021-09773 PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs…Priority LOW 38
    Show all 6 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-28709
  2. 2026-10-03 Alias added: GHSA-5rjh-29pm-3mx4

References

Patch 1

Advisory 4

  • TI-2012-00210 The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix… CVSS 2.0HIGH 7.2
  • TI-2023-07042 Information disclosure through error messages in AMD Ryzen™ 3000 Series Desktop… CVSS 3.1MEDIUM 5.5
  • TI-2015-04333 The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used… CVSS 2.0HIGH 9.3
  • TI-2015-06741 The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows… CVSS 3.1CRITICAL 10.0
  • TI-2018-06436 A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures… CVSS 3.0HIGH 7.8
  • TI-2024-20522 x86: Incorrect logic for BTC/SRSO mitigations CVSS 3.1HIGH 7.5
See all 489 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences