CVE-2021-28700

In Xen's dom0less feature, unprivileged domains can allocate unlimited memory, bypassing the administrator's configured limits. This allows a single domain to consume all available memory and crash the entire system.

The dom0less feature in Xen/ARM fails to enforce memory limits on unprivileged domains created directly by the hypervisor. An authenticated domain administrator can trigger unbounded memory allocation, leading to resource exhaustion and denial of service across the virtualized environment. Mitigation requires explicit memory limit configuration at domain creation time.