CVE-2021-28693: xen
Vulnerability summary
CVE-2021-28693 is a medium (CVSS 5.5) vulnerability in xen. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 30-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed on Arm.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
0.00 pp
From 0.32% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Alpine1 product
- xen≥ 4.12.0, < 4.13.3-r1 | ≥ 4.12.0, < 4.14.1-r3 | ≥ 4.12.0, < 4.15.0-r1
Debian1 product
- xen< 4.14.2+25-gb6a8c4f72d-1
Ubuntu1 product
- xenAll versions (No fix recorded)
Xen1 product
- xen≥ 4.15.0, < 4.16.0 | ≥ 4.13.x, < unspecified | xen-unstable | ≥ 4.12.0, < 4.13.0 | ≥ 4.12.0, ≤ 4.15.0 | 4.15.0:rc1
4 vendors · 4 products
