CVE-2021-28706

Katalog CVE

CVSS 8.6 · High EPSS 2,2%

Kerentanan Allocation of Resources Without Limits or Throttling pada xen, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.

Rincian

Terbit di NVD

24 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 82,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://xenbits.xenproject.org/xsa/advisory-385.txt mitigasi · patch · advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-5017 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7ZGWVVRI4XY2...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXUI4VMD52CH3...
• https://security.gentoo.org/glsa/202402-07