LiveActive security incident?Get immediate response
CVE Record

CVE-2021-28700: xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple...

xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the memory limit from them is not set. This allow a domain to allocate memory beyond what an administrator originally configured.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

On Xen for Arm, a dom0less guest may use more memory than administrators assigned to it. This weakens resource isolation and could cause capacity pressure or instability for other workloads on affected hosts. The supplied sources do not report active exploitation.

Executive priority

Treat this as targeted infrastructure risk, not a broad internet-facing emergency. Prioritize remediation where Xen/Arm dom0less supports important workloads, because the issue undermines memory allocation controls and could affect reliability.

Technical view

CVE-2021-28700 affects Xen/Arm dom0less domains because configured memory limits are not applied. An unprivileged domain can allocate memory beyond its configured amount. The bundle lists Xen 4.12.x, 4.13.x, unspecified versions, and xen-unstable as affected, with downstream advisories from Debian, Fedora, and Gentoo.

Likely exposure

Exposure is likely limited to Xen on Arm deployments using the dom0less feature to launch unprivileged domains directly from Xen. Organizations not using Xen/Arm dom0less are less likely to be exposed based on the supplied description.

Exploitation context

The source bundle marks KEV as false and provides no cited evidence of active exploitation. The realistic concern is resource isolation failure: a dom0less guest exceeding intended memory allocation, potentially affecting host capacity or co-resident domains.

Researcher notes

Evidence is sparse: no CVSS, CWE, exploit status, or detailed fix mechanics are provided in the bundle. Analysis should stay tied to XSA-383 and downstream distribution advisories. Do not assume impact beyond Xen/Arm dom0less memory-limit enforcement.

Mitigation direction

  • Review Xen XSA-383 and distribution advisories for fixed package guidance.
  • Update Xen packages from Debian, Fedora, Gentoo, or the relevant vendor channel.
  • Prioritize hosts using Xen/Arm dom0less configurations.
  • Check vendor guidance before applying operational workarounds not named in the sources.

Validation and detection

  • Inventory Xen hosts and identify Arm systems using dom0less domains.
  • Confirm installed Xen versions against affected 4.12.x, 4.13.x, and vendor advisory scope.
  • Verify whether updated distribution packages addressing XSA-383 are installed.
  • Review domain memory configurations for dom0less guests and monitor unexpected memory pressure.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-28700 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Xenxen4.12.xListed
Xenxenunspecified, 4.13.x, next of xen-unstableListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.