CVE-2021-28706

CVE-2021-28706: vulnerability in xen

Published · Updated

Follow this CVE+ Monitor Xen+ Monitor xen

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.2%
In short

A guest virtual machine can exceed its memory limit by exploiting a calculation error in the hypervisor. When allocated nearly 16TB of memory, it can request more than allowed, bypassing the administrator's restrictions.

Technical detail

CVE-2021-28706 involves an integer overflow in hypercall processing where 32-bit arithmetic on large memory values (near 16TiB) causes the allocation check to compare an overflowed small value against the upper bound instead of the actual requested amount. An authenticated guest with near-maximum memory allocation can exploit this to exceed administrator-enforced memory limits, potentially impacting host stability and resource isolation.

Summary generated and translated by AI from the official description.
guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.
Affected products
Xen · xen
Related CVEs — xen

In the same product, most dangerous first.

CVE-2021-28700—CVE-2021-28700EPSS 1.9%CVE-2022-42330—CVE-2022-42330EPSS 1.4%CVE-2022-42333—CVE-2022-42333EPSS 1.2%CVE-2021-28690—CVE-2021-28690EPSS 1.0%CVE-2022-26364—CVE-2022-26364EPSS 0.5%CVE-2021-28702—CVE-2021-28702EPSS 0.4%