CVE-2021-28700

2021-08-2718:15:52

XEN

www.cve.org

6.4 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.5%

JSON

xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the memory limit from them is not set. This allow a domain to allocate memory beyond what an administrator originally configured.

CNA Affected

[
  {
    "product": "xen",
    "vendor": "Xen",
    "versions": [
      {
        "status": "affected",
        "version": "4.12.x"
      }
    ]
  },
  {
    "product": "xen",
    "vendor": "Xen",
    "versions": [
      {
        "lessThan": "4.12",
        "status": "unknown",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.13.x",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "next of xen-unstable",
        "versionType": "custom"
      }
    ]
  }
]