medium6.5
CVE-2021-28039
An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen.
Impact
An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom0 or driver domain via a large amount of I/O activity. The issue relates to misuse of guest physical addresses when a configuration has CONFIG_XEN_UNPOPULATED_ALLOC but not CONFIG_XEN_BALLOON_MEMORY_HOTPLUG.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linux | Linux Kernel | from 5.9.0 through 5.11.3 |
| Xen | Xen | All versions |
| Netapp | Cloud Backup | All versions |
| Netapp | Solidfire Baseboard Management Controller Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2021/03/05/2
- http://xenbits.xen.org/xsa/advisory-369.html
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=882213990d32fd224340a4533f6318dd152be4b2
- https://security.netapp.com/advisory/ntap-20210409-0001/
- http://www.openwall.com/lists/oss-security/2021/03/05/2
- http://xenbits.xen.org/xsa/advisory-369.html
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=882213990d32fd224340a4533f6318dd152be4b2
- https://security.netapp.com/advisory/ntap-20210409-0001/