CVE-2021-28700: vulnerability in xen
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
In Xen's dom0less feature, unprivileged domains can allocate unlimited memory, bypassing the administrator's configured limits. This allows a single domain to consume all available memory and crash the entire system.
The dom0less feature in Xen/ARM fails to enforce memory limits on unprivileged domains created directly by the hypervisor. An authenticated domain administrator can trigger unbounded memory allocation, leading to resource exhaustion and denial of service across the virtualized environment. Mitigation requires explicit memory limit configuration at domain creation time.
In the same product, most dangerous first.