CVE-2021-28038

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2021/03/05/1Mailing List, Patch, Third Party Advisory
http://xenbits.xen.org/xsa/advisory-367.htmlPatch, Vendor Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2991397d23ec597405b116d96de3813420bdcbc3
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlThird Party Advisory
https://security.netapp.com/advisory/ntap-20210409-0001/Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/03/05/1Mailing List, Patch, Third Party Advisory
http://xenbits.xen.org/xsa/advisory-367.htmlPatch, Vendor Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2991397d23ec597405b116d96de3813420bdcbc3
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlThird Party Advisory
https://security.netapp.com/advisory/ntap-20210409-0001/Third Party Advisory

Timeline

Published: Mar 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-280396.5An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS u CVE-2021-280407.5An issue was discovered in OSSEC 3.6.0. An uncontrolled recursion vulnerability in os_xml.c occurs when a large number of opening and closin CVE-2021-280417.1ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket ac CVE-2021-280427.8Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Conne CVE-2021-280475.4Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users t CVE-2021-280486.5An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to CVE-2021-280524.9A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allo CVE-2021-280538.8An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A SQL injection vulnerability in "Configuration > Users > Contacts / U CVE-2021-280545.4An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A Stored Cross-Site Scripting (XSS) issue in "Configuration > Hosts" a CVE-2021-280556.5An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF CVE-2021-280605.3A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs CVE-2021-280704.3Cross Site Request Forgery (CSRF) vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete.