{"id":"CVE-2021-28708","aliases":["ALPINE-CVE-2021-28708","DEBIAN-CVE-2021-28708","DSA-5017-1","EUVD-2021-15365","GHSA-959p-vvwh-xj92","SUSE-SU-2021:3813-1","SUSE-SU-2021:3842-1","SUSE-SU-2021:3849-1","SUSE-SU-2021:3851-1","SUSE-SU-2021:3852-1","SUSE-SU-2021:3888-1","SUSE-SU-2021:3968-1","SUSE-SU-2021:3977-1","UBUNTU-CVE-2021-28708","openSUSE-SU-2021:1543-1","openSUSE-SU-2021:3968-1"],"status":"published","title":"PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text...","description":"PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00353,"percentile":0.29325,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2021-11-24T00:00:00Z","modified":"2026-10-23T18:03:57Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"xen","fixed_in":["4.13.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"xen","fixed_in":["4.13.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"xen","fixed_in":["4.14.3-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"xen","fixed_in":["4.15.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"xen","fixed_in":["4.15.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"xen","fixed_in":["4.15.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"xen","fixed_in":["4.15.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"xen","fixed_in":["4.15.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xen","fixed_in":["4.15.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xen","fixed_in":["4.15.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.15.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.15.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.15.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.15.1-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.14.3+32-g9de3671772-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.14.3+32-g9de3671772-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.14.3+32-g9de3671772-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.13.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.13.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.14.3-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.15.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.15.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.15.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.15.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.15.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.15.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.15.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.15.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.15.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.15.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.15.1-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3+32-g9de3671772-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3+32-g9de3671772-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3+32-g9de3671772-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3+32-g9de3671772-1~deb11u1"}]}],"versions":["4.14.2+25-gb6a8c4f72d-2","4.14.3-1","4.14.3-1~deb11u1"],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.6_18-43.82.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.4_30-3.68.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.4_30-3.68.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.4_30-3.68.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4_24-2.65.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4_24-2.65.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4_24-2.65.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4_24-2.65.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_24-3.97.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_24-3.97.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_24-3.97.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_24-3.97.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_24-3.97.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_24-3.97.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_16-3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_16-3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_16-3.55.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.4_02-3.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.4_02-3.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.4_02-3.40.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3_04-3.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3_04-3.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3_04-3.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_16-3.57.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_16-3.57.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_16-3.57.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_16-3.57.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_16-3.57.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_16-3.57.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1","4.6.5-0ubuntu1.1","4.6.5-0ubuntu1.2","4.6.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0-0ubuntu3","4.9.0-0ubuntu4","4.9.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2","4.11.3+24-g14b62ab3e5-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.4+24-gddaaccbbab-1ubuntu2","4.16.0-1~ubuntu2","4.16.0-1~ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.17.2-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1ubuntu1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1ubuntu2","4.17.3+10-g091466ba55-1.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0-1ubuntu1","4.20.0+68-g35cb38b222-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.2+7-g1badcf5035-2build2","4.20.2+37-g61ff35323e-1ubuntu1","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+7-g1badcf5035-2","4.20.2+7-g1badcf5035-2build2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.4_02-lp152.2.33.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3_04-3.15.1"}]}],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-388.txt","tags":["x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7ZGWVVRI4XY2XSTBI3XEMWBXPDVX6OT/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://www.debian.org/security/2021/dsa-5017","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXUI4VMD52CH3T7YXAG3J2JW7ZNN3SXF/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202402-07","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28708"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I7ZGWVVRI4XY2XSTBI3XEMWBXPDVX6OT/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXUI4VMD52CH3T7YXAG3J2JW7ZNN3SXF/"},{"url":"https://github.com/advisories/GHSA-959p-vvwh-xj92"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-28708","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28708","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213813-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1192554","tags":["report"]},{"url":"https://bugzilla.suse.com/1192557","tags":["report"]},{"url":"https://bugzilla.suse.com/1192559","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28709","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213842-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189373","tags":["report"]},{"url":"https://bugzilla.suse.com/1189378","tags":["report"]},{"url":"https://bugzilla.suse.com/1189632","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28701","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213849-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213851-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213852-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://bugzilla.suse.com/1191363","tags":["report"]},{"url":"https://bugzilla.suse.com/1191510","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28702","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213888-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213968-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213977-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-28708","tags":["report"]},{"url":"https://xenbits.xen.org/xsa/advisory-388.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28708","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HUTTCXZ3RCSXYS25JPMTEXNGYRSDKJ26/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ELAKLWY4EZXSLS4BS47VPF2URIP3BLNK/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-28708","description":"PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).","status":"published","published":"2021-11-24T00:00:00Z","modified":"2024-11-18T20:21:14.819Z","updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-15365","description":"PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).","status":"published","published":"2021-11-24T00:00:00Z","modified":"2024-11-18T20:21:14Z","updated_at":"2026-11-03T00:04:56.531722Z"}],"ghsa":[{"id":"GHSA-959p-vvwh-xj92","title":"PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text...","description":"PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).","status":"published","published":"2021-11-25T00:00:39Z","modified":"2024-02-13T05:07:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:55:36.780787Z"}],"nvd":[{"id":"CVE-2021-28708","description":"PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).","status":"published","published":"2021-11-24T01:15:08.217Z","modified":"2026-06-17T03:46:50.76Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:01.428028Z"}],"osv":[{"id":"ALPINE-CVE-2021-28708","description":"PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).","status":"published","published":"2021-11-24T01:15:08.217Z","modified":"2026-10-23T17:17:56.178621866Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"CVE-2021-28708","description":"PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).","status":"published","published":"2021-11-24T01:15:08.217Z","modified":"2026-03-14T14:57:14.414537Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28708","description":"PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).","status":"published","published":"2021-11-24T01:15:08.217Z","modified":"2026-10-23T18:03:57.734397746Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"UBUNTU-CVE-2021-28708","description":"PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).","status":"published","published":"2021-11-24T01:15:00Z","modified":"2026-10-17T12:57:12.882056248Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DSA-5017-1","title":"xen - security update","status":"published","published":"2021-12-05T00:00:00Z","modified":"2026-03-09T02:08:50.626456Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"openSUSE-SU-2021:1543-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly (XSA-386) (bsc#1191363).\n- CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557).\n- CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559).\n- CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554).\n\n- Update to Xen 4.13.4 bug fix release (bsc#1027519).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-12-06T13:07:00Z","modified":"2026-02-04T03:22:19.174315Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3968-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly (XSA-386) (bsc#1191363).\n- CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557).\n- CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559).\n- CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554).\n\n- Update to Xen 4.14.3 bug fix release (bsc#1027519).\n","status":"published","published":"2021-12-07T14:31:08Z","modified":"2026-02-04T03:47:29.856094Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:3813-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557).\n- CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559).\n- CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554).\n","status":"published","published":"2021-11-29T11:15:02Z","modified":"2026-02-04T04:22:07.317545Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3842-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2021-28701: Fixed race condition in XENMAPSPACE_grant_table handling (XSA-384) (bsc#1189632).\n- CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557).\n- CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559).\n- CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554).\n\n- Integrate bugfixes (bsc#1189373, bsc#1189378).\n","status":"published","published":"2021-12-01T15:17:58Z","modified":"2026-02-04T02:54:27.909907Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3849-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2021-28701: Fixed race condition in XENMAPSPACE_grant_table handling (XSA-384) (bsc#1189632).\n- CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557).\n- CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559).\n- CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554).\n- Integrate bugfixes (bsc#1189373, bsc#1189378)\n","status":"published","published":"2021-12-01T15:56:49Z","modified":"2026-02-04T02:24:30.056943Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3851-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557).\n- CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559).\n- CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554).\n","status":"published","published":"2021-12-01T15:57:36Z","modified":"2026-02-04T04:24:09.514369Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3852-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly (XSA-386) (bsc#1191363).\n- CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557).\n- CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559).\n- CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554).\n\n- Fixed 15sp4 uefi fv guest on 12sp5 host unable to bootup with sriov pci device plugin (bsc#1191510).\n- Upstream bug fixes (bsc#1027519).\n","status":"published","published":"2021-12-01T15:57:55Z","modified":"2026-02-04T03:03:03.333179Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3888-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly (XSA-386) (bsc#1191363).\n- CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557).\n- CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559).\n- CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554).\n\n- Update to Xen 4.13.4 bug fix release (bsc#1027519).\n","status":"published","published":"2021-12-03T08:47:48Z","modified":"2026-02-04T03:40:31.162395Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3968-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly (XSA-386) (bsc#1191363).\n- CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557).\n- CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559).\n- CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554).\n\n- Update to Xen 4.14.3 bug fix release (bsc#1027519).\n","status":"published","published":"2021-12-07T14:31:13Z","modified":"2026-02-04T03:28:07.240515Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2021:3977-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2021-28701: Fixed race condition in XENMAPSPACE_grant_table handling (XSA-384) (bsc#1189632).\n- CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly (XSA-386) (bsc#1191363).\n- CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs (XSA-388) (bsc#1192557).\n- CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559).\n- CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554).\n\n- Upstream bug fixes (bsc#1027519)\n","status":"published","published":"2021-12-09T10:05:29Z","modified":"2026-02-04T03:03:32.175208Z","updated_at":"2026-11-02T15:53:50.066806Z"}]}}