CVE-2021-28696IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
- 6.8MediumCVSS base score
- 0.36%Exploitation in 30 daysEPSS · top 70% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696).
Timeline
ID reserved
By XEN
- 5 months later
· 5 months later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.36% · top 70% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.
Affected products
References
References9
- https://xenbits.xenproject.org/xsa/advisory-378.txt (opens in a new tab)x_refsource_MISCx_transferred
- [oss-security] 20210901 Xen Security Advisory 378 v3 (CVE-2021-28694,CVE-2021-28695,CVE-2021-28696) - IOMMU page mapping issues on x86 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [oss-security] 20210901 Re: Xen Security Advisory 378 v3 (CVE-2021-28694,CVE-2021-28695,CVE-2021-28696) - IOMMU page mapping issues on x86 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [oss-security] 20210901 Re: Xen Security Advisory 378 v3 (CVE-2021-28694,CVE-2021-28695,CVE-2021-28696) - IOMMU page mapping issues on x86 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- FEDORA-2021-4f129cc0c1 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- FEDORA-2021-d68ed12e46 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- DSA-4977 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- FEDORA-2021-081f9bf5d2 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- GLSA-202208-23 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2021-15353 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2021-28696)Record last updated .