CVE-2021-28689

MITRE NVD CVE.ORG Print: PDF PDF

Summary

CVECVE-2021-28689
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2021-06-11 15:15:00 UTC
Updated2023-08-08 14:21:00 UTC
Descriptionx86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not architecturally protect ring 0 from predictions learnt in ring 1. For more details, see: https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-speculation Similar situations may exist with other mitigations for other kinds of speculative execution attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to be discovered, disclosed, or mitigated.

Risk And Classification

Problem Types: CWE-212

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Xen Xen All All All All

References

ReferenceSourceLinkTags
xenbits.xenproject.org/xsa/advisory-370.txt MISC xenbits.xenproject.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Vendor Comments And Credit

Discovery Credit

LEGACY: Array

Legacy QID Mappings

  • 750030 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2021:1648-1)
  • 752684 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3665-1)
  • 752719 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3728-1)
  • 752778 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3925-1)
  • 752781 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3928-1)
  • 752796 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3971-1)
  • 752887 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:4241-1)
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report