CVE-2021-28693

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed on Arm.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-286946.8IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr CVE-2021-286956.8IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr CVE-2021-286966.8IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr CVE-2021-286977.8grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The m CVE-2021-286985.5long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a doma CVE-2021-286995.5inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, whe CVE-2021-287004.9xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly fr CVE-2021-287017.8Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such page CVE-2021-287027.6PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Res CVE-2021-287037.0grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of me CVE-2021-287048.8PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor CVE-2021-287057.8issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/v