7.1
CVSSv3

CVE-2021-28692

Published: 30/06/2021 Updated: 12/07/2021
CVSS v2 Base Score: 5.6 | Impact Score: 7.8 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.1 | Impact Score: 5.2 | Exploitability Score: 1.8
VMScore: 498
Vector: AV:L/AC:L/Au:N/C:P/I:N/A:C

Vulnerability Summary

inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completion of such commands is not used. Instead, the issuing CPU spin-waits for the completion of the most recently issued command(s). Some of these waiting loops try to apply a timeout to fail overly-slow commands. The course of action upon a perceived timeout actually being detected is inappropriate: - on Intel hardware guests which did not originally cause the timeout may be marked as crashed, - on AMD hardware higher layer callers would not be notified of the issue, making them continue as if the IOMMU operation succeeded.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

xen xen

Vendor Advisories

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service or information leaks For the stable distribution (buster), these problems have been fixed in version 4114+107-gef32c7afa2-1 We recommend that you upgrade your xen packages For the detailed security status of xen please refer to its secu ...
Several security issues have been identified that affect Citrix Hypervisor:Two issues, each of which may each allow privileged code in a guest VM to cause the host to crash or become unresponsive  These two issues only affect systems where the malicious guest VM has a physical PCI device passed through to it by the host administratorThese is ...

Mailing Lists

<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> Xen Security Advisory 373 v2 (CVE-2021-28692) - inappropriate x86 IOMMU timeout detection / handling <!--X-Subject-Header-End- ...