Detections
Analytics

Alpine: xen: security update to 4.13.2-r4

medium Tenable Self-Hosted Container Security Plugin ID 407778

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI
 pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with
 MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the
 MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system,
 not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices
 can mount a Denial of Service (DoS) attack affecting the pass through of PCI devices to other guests or
 the hardware domain. In the latter case, this would affect the entire host. (CVE-2021-3308)

See Also

https://security.alpinelinux.org/vuln/CVE-2021-3308

Plugin Details

Severity: Medium

ID: 407778

Version: Revision 1.25

Type: Local

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2021-3308

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 1/21/2021

Reference Information

CVE: CVE-2021-3308