CVE-2021-28687
Summary
| CVE | CVE-2021-28687 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-06-11 15:15:00 UTC |
| Updated | 2021-09-20 13:51:00 UTC |
| Description | HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of them. When the "soft reset" feature was implemented, the libxl__domain_suspend_state structure didn't require any initialization or disposal. At some point later, an initialization function was introduced for the structure; but the "soft reset" path wasn't refactored to call the initialization function. When a guest nwo initiates a "soft reboot", uninitialized data structure leads to an assert() when later code finds the structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How this affects the system depends on the structure of the toolstack. For xl, this will have no security-relevant effect: every VM has its own independent monitoring process, which contains no state. The domain in question will hang in a crashed state, but can be destroyed by `xl destroy` just like any other non-cooperating domain. For daemon-based toolstacks linked against libxl, such as libvirt, this will crash the toolstack, losing the state of any in-progress operations (localized DoS), and preventing further administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If crashes "leak" resources, then repeated crashes could use up resources, also causing a system-wide DoS. |
Risk And Classification
Problem Types: CWE-909
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| xenbits.xenproject.org/xsa/advisory-368.txt | MISC | xenbits.xenproject.org | |
| Xen: Multiple vulnerabilities (GLSA 202107-30) — Gentoo security | GENTOO | security.gentoo.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Array
Legacy QID Mappings
- 174871 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2021:1028-1)
- 174875 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2021:1023-1)
- 174972 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2021:1460-1)
- 180377 Debian Security Update for xen (CVE-2021-28687)
- 281448 Fedora Security Update for xen (FEDORA-2021-a468f36bbe)
- 281449 Fedora Security Update for xen (FEDORA-2021-0b784a4d02)
- 281451 Fedora Security Update for xen (FEDORA-2021-7b4dcfcb6d)
- 500799 Alpine Linux Security Update for xen
- 501795 Alpine Linux Security Update for xen
- 504542 Alpine Linux Security Update for xen
- 710038 Gentoo Linux Xen Multiple vulnerabilities (GLSA 202107-30)