CVE-2021-28693

low-risk

Published 2021-06-30

xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed on Arm.

Do I need to act?

0.06% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (2)

Xen

Affected Vendors

Xen

References (4)

Third Party Advisory https://security.gentoo.org/glsa/202107-30

Vendor Advisory https://xenbits.xenproject.org/xsa/advisory-372.txt

Third Party Advisory https://security.gentoo.org/glsa/202107-30

Vendor Advisory https://xenbits.xenproject.org/xsa/advisory-372.txt

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 7/34 · Low