CVE-2021-28706

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Nov 24, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-287078.8PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corCVE-2021-287088.8PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corCVE-2021-287097.8issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vCVE-2021-287108.8certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structures (page tables) may CVE-2021-287116.5Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains whCVE-2021-287126.5Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains whCVE-2021-287136.5Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains whCVE-2021-287146.5Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text eCVE-2021-287156.5Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text eCVE-2021-287897.8The unofficial apple/swift-format extension before 1.1.2 for Visual Studio Code allows remote attackers to execute arbitrary code by construCVE-2021-287907.8The unofficial SwiftLint extension before 1.4.5 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a mCVE-2021-287917.8The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a
CVE-2021-28706: High severity, CVSS 8.6 | Vulnix