Skip to content
Fencer Vulns
high 7.0

CVE-2021-28703 json

grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of m…

published 2021-12-07 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-15360

cvss
7.0
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits
0
none known

Summary

grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes. This bug was fortuitously fixed by code cleanup in Xen 4.14, and backported to security-supported Xen branches as a prerequisite of the fix for XSA-378.

Patch / fix

  • Xen Project Xen Branch 4.13.4 4.13.4, Branch 4.14.x 4.14.x, Branch 4.15.x 4.15.x
  • xen Debian 14, Debian 13, Debian 12 4.14.0+80-gd101b417b7-1

debian advisories DEBIAN-CVE-2021-28703

  • xen SLES 11 SP4-LTSS 4.4.4_50-61.67.1

suse advisories SUSE-SU-2021:14848-1

  • xen Alpine 3.12, Alpine 3.11 4.13.4-r0
  • xen Alpine 3.13 4.14.5-r0
  • xen Alpine 3.15, Alpine 3.14 4.15.2-r0
  • xen Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 4.15.1-r1

alpine advisories ALPINE-CVE-2021-28703

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • Xen Project Xen

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.