Detections
Analytics
Alpine: multiple xen packages: security update to 4.14.1-r2
medium Tenable Self-Hosted Container Security Plugin ID 424719
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI
pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with
MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the
MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system,
not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices
can mount a Denial of Service (DoS) attack affecting the pass through of PCI devices to other guests or
the hardware domain. In the latter case, this would affect the entire host. (CVE-2021-3308)
- An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory
accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones
during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the
operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no
guarantee when all the writes will reach the memory. (CVE-2021-26933)
See Also
Plugin Details
Severity: Medium
ID: 424719
Version: Revision 1.8
Type: Local
Published: 4/4/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
CVSS v2
Risk Factor: Low
Base Score: 2.1
Temporal Score: 1.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2021-26933
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 1/21/2021
Reference Information
CVE: CVE-2021-26933, CVE-2021-3308
IAVB: 2021-B-0011-S