Detections
Analytics
Alpine: xen: security update to 4.13.3-r0
medium Tenable Self-Hosted Container Security Plugin ID 407780
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to
be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal
data structures also require this initialize / dispose discipline, but not all of them. When the "soft
reset" feature was implemented, the libxl__domain_suspend_state structure didn't require any
initialization or disposal. At some point later, an initialization function was introduced for the
structure; but the "soft reset" path wasn't refactored to call the initialization function. When a guest
nwo initiates a "soft reboot", uninitialized data structure leads to an assert() when later code finds the
structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How
this affects the system depends on the structure of the toolstack. For xl, this will have no security-
relevant effect: every VM has its own independent monitoring process, which contains no state. The domain
in question will hang in a crashed state, but can be destroyed by `xl destroy` just like any other non-
cooperating domain. For daemon-based toolstacks linked against libxl, such as libvirt, this will crash the
toolstack, losing the state of any in-progress operations (localized DoS), and preventing further
administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If
crashes "leak" resources, then repeated crashes could use up resources, also causing a system-wide DoS.
(CVE-2021-28687)
See Also
Plugin Details
Severity: Medium
ID: 407780
Version: Revision 1.25
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
CVSS v2
Risk Factor: Medium
Base Score: 4.9
Temporal Score: 3.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2021-28687
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 2/18/2021
Reference Information
CVE: CVE-2021-28687
IAVB: 2021-B-0011-S