Lucene search

[email protected]CVE-2021-28702

HistoryOct 06, 2021 - 2:15 p.m.

CVE-2021-28702

2021-10-0614:15:07

CWE-269

[email protected]

web.nvd.nist.gov

pci

rmrr

deassign

iommu

dma

interrupts

security vulnerability

nvd

cve-2021-28702

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.6 High

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.6%

JSON

PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, “RMRR”). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest, then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure, including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour, ranging from IOMMU faults to memory corruption.

Affected configurations

NVD

Node

xenxenRange4.13.0–4.15.1

Node

fedoraprojectfedoraMatch33

fedoraprojectfedoraMatch34

fedoraprojectfedoraMatch35

Node

debiandebian_linuxMatch9.0

CPENameOperatorVersion
xen:xenxenle4.15.1

CPE	Name	Operator	Version
xen:xen	xen	le	4.15.1

CNA Affected

[
  {
    "product": "xen",
    "vendor": "Xen",
    "versions": [
      {
        "lessThan": "4.12",
        "status": "unknown",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.12.x",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "next of xen-unstable",
        "versionType": "custom"
      }
    ]
  }
]