CVE-2021-28702

Katalog CVE

CVSS 7.6 · High EPSS 0,44%

Kerentanan Improper Privilege Management pada xen, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 7.6 (High) menurut NVD.

Deskripsi (NVD)

PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest, then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure, including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour, ranging from IOMMU faults to memory corruption.

Rincian

Terbit di NVD

6 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.6 (High), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://xenbits.xenproject.org/xsa/advisory-386.txt advisory vendor
• http://www.openwall.com/lists/oss-security/2021/10/07/2 mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-23 advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-5017 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OIHEJ3R3EH5D...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDPRMOBBLS74O...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRAWV6PO2KUGV...