LiveActive security incident?Get immediate response
CVE Record

CVE-2021-28708: PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains...

PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-28708 is a Xen hypervisor denial-of-service issue. Certain x86 HVM or PVH guest memory operations in populate-on-demand mode can trigger a host crash when unsupported page orders are handled incorrectly. The business risk is disruption across workloads on the affected host, especially where untrusted or tenant-controlled guests run.

Executive priority

Treat this as a priority infrastructure availability issue if the organization runs affected Xen hosts. It is not evidenced as actively exploited in the bundle, but a guest-triggered host crash can interrupt multiple services and tenants from one vulnerable hypervisor.

Technical view

The issue is in Xen PoD handling for XENMEM_decrease_reservation. The advisory says host crash is possible when the page order is neither 4k, 2M, nor 1G. The source bundle names Xen 4.12.x, 4.15.x, later 4.14.x lineage, unspecified Xen, and xen-unstable as affected, but does not provide CVSS.

Likely exposure

Exposure is most likely on x86 Xen hosts running affected versions with HVM or PVH guests using populate-on-demand memory. Environments without Xen, without affected guest types, or already updated through vendor security advisories are less likely exposed. Version-level fixed status must be confirmed against Xen or distribution guidance.

Exploitation context

The provided sources do not show active exploitation, and the CVE is not marked KEV. The described impact is host crash from guest-controllable memory hypercall behavior, which is most concerning in shared hosting, cloud, lab, or other multi-tenant Xen deployments.

Researcher notes

The CNA text covers multiple related CVEs. For CVE-2021-28708 specifically, focus on XENMEM_decrease_reservation handling where unsupported page orders can crash the host. Do not conflate this with CVE-2021-28704 or CVE-2021-28707 except as part of the same advisory context.

Mitigation direction

  • Apply Xen Project XSA-388 fixes or distribution security updates for Xen.
  • Prioritize shared or untrusted-guest Xen hosts for maintenance windows.
  • Check Debian, Fedora, Gentoo, or vendor advisories for fixed package versions.
  • Reduce exposure of untrusted guests until affected hosts are updated.
  • Monitor vendor guidance for any environment-specific mitigations.

Validation and detection

  • Inventory Xen hypervisor versions across virtualization hosts.
  • Identify x86 HVM or PVH guests using populate-on-demand memory behavior.
  • Confirm installed Xen packages include XSA-388-related fixes.
  • Review hypervisor stability logs for unexplained guest-triggered host crashes.
  • Verify distribution advisories map to the deployed package branch.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-28708 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Xenxenxen-unstableListed
Xenxenunspecified, 4.12.x, next of 4.14.xListed
Xenxen4.15.xListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.