7.6

CVE-2021-28702: debian debian_linux Improper Privilege Management

CVSS: 7.6v3.1HighModified
AliasesALPINE-CVE-2021-28702UBUNTU-CVE-2021-28702DEBIAN-CVE-2021-28702
Published 06-10-2021Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2021-28702 is a high (CVSS 7.6) Improper Privilege Management vulnerability in debian debian_linux. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.2% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.6/10
010
High · v3.1 (NVD)
EPSS score
0.44%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 6
DSA-5017-1OPENSUSE-SU-2021:1543-1OPENSUSE-SU-2021:3968-1SUSE-SU-2021:3852-1SUSE-SU-2021:3888-1SUSE-SU-2021:3968-1

Timeline

  1. 06-10-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest, then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure, including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour, ranging from IOMMU faults to memory corruption.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

0.00 pp

From 0.44% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
Alpine1 product
  • xen≥ 4.13.0, < 4.13.4-r1 | ≥ 4.13.0, < 4.14.3-r1 | ≥ 4.13.0, < 4.15.1-r1
Fedoraproject1 product
Opensuse1 product
  • xen&distro=openSUSE Tumbleweed< 4.16.0_01-1.1
Ubuntu1 product
  • xenAll versions (No fix recorded)
Xen1 product
  • xen≥ 4.12.x, < unspecified | ≥ 4.13.0, ≤ 4.15.1

6 vendors · 7 products

References

13 links
Show all 13 references