CVE-2021-28690: xen
Vulnerability summary
CVE-2021-28690 is a medium (CVSS 6.5) vulnerability in xen. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 61.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 12 · Related 11Timeline
- 29-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please see https://xenbits.xen.org/xsa/advisory-305.html for details. Mitigating TAA by disabling TSX (the default and preferred option) requires selecting a non-default setting in MSR_TSX_CTRL. This setting isn't restored after S3 suspend.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.99%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
-0.03 pp
From 1.02% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Alpine1 product
- xen≥ 4.12, < 4.13.3-r1 | ≥ 4.12, < 4.14.1-r3 | ≥ 4.12, < 4.15.0-r1
Debian1 product
- xen< 4.14.2+25-gb6a8c4f72d-1
Ubuntu1 product
- xenAll versions (No fix recorded)
Xen1 product
- xen≥ 4.13.x, < unspecified | ≥ 4.12.0, < 4.13.0 | ≥ 4.11.0, < 4.12.0 | ≥ 4.12, ≤ 4.15.0 | 4.15.0:rc1
4 vendors · 4 products
