Description
An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system, not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices can mount a Denial of Service (DoS) attack affecting the pass through of PCI devices to other guests or the hardware domain. In the latter case, this would affect the entire host.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.14.1+11-gb0b734a8b3-1 | — |
| Debian 13 | xen | 4.14.1+11-gb0b734a8b3-1 | — |
| Debian 12 | xen | 4.14.1+11-gb0b734a8b3-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | xen | 4.13.2_08-3.25.3 | SUSE-SU-2021:1028-1 |
| SLES 15 SP1 | xen | 4.12.4_08-3.43.3 | SUSE-SU-2021:1460-1 |
| SLES 12 SP5 | xen | 4.12.4_09-3.39.3 | SUSE-SU-2021:1023-1 |
| SLES 12 SP4 | xen | 4.11.4_20-2.60.1 | SUSE-SU-2021:2955-1 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP1 | xen | 4.12.4_08-3.43.3 | SUSE-SU-2021:1460-1 |
| SLES for SAP 12 SP5 | xen | 4.12.4_09-3.39.3 | SUSE-SU-2021:1023-1 |
| SLES for SAP 12 SP4 | xen | 4.11.4_20-2.60.1 | SUSE-SU-2021:2955-1 |
| SLE Micro 5.0 | xen | 4.13.2_08-3.25.3 | SUSE-SU-2021:1028-1 |
| SLE HPC 15 SP1 | xen | 4.12.4_08-3.43.3 | SUSE-SU-2021:1460-1 |
| SUSE OpenStack Cloud Crowbar 9 | xen | 4.11.4_20-2.60.1 | SUSE-SU-2021:2955-1 |
| SUSE OpenStack Cloud 9 | xen | 4.11.4_20-2.60.1 | SUSE-SU-2021:2955-1 |
| SUSE Manager Server 4.0 | xen | 4.12.4_08-3.43.3 | SUSE-SU-2021:1460-1 |
| SUSE Manager Retail Branch Server 4.0 | xen | 4.12.4_08-3.43.3 | SUSE-SU-2021:1460-1 |
| SUSE Manager Proxy 4.0 | xen | 4.12.4_08-3.43.3 | SUSE-SU-2021:1460-1 |
| SUSE Enterprise Storage 6 | xen | 4.12.4_08-3.43.3 | SUSE-SU-2021:1460-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | xen | 4.14.1-r2 | — |
| Alpine v3.23 | xen | 4.14.1-r2 | — |
| Alpine v3.22 | xen | 4.14.1-r2 | — |
| Alpine v3.21 | xen | 4.14.1-r2 | — |
| Alpine v3.20 | xen | 4.14.1-r2 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | xen | 4.14.1-r2 | — |
| Alpine v3.18 | xen | 4.14.1-r2 | — |
| Alpine v3.17 | xen | 4.14.1-r2 | — |
| Alpine v3.16 | xen | 4.14.1-r2 | — |
| Alpine v3.15 | xen | 4.14.1-r2 | — |
| Alpine v3.14 | xen | 4.14.1-r2 | — |
| Alpine v3.13 | xen | 4.14.1-r1 | — |
| Alpine v3.12 | xen | 4.13.2-r4 | — |
| Alpine v3.11 | xen | 4.13.2-r4 | — |
Advisories 4
- SUSE-SU-2021:2955-1 Security update for xen SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1028-1 Security update for xen SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1023-1 Security update for xen SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1460-1 Security update for xen SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://xenbits.xen.org/xsa/advisory-360.html
- [oss-security] 20210126 Xen Security Advisory 360 v2 (CVE-2021-3308) - IRQ vector leak on x86 mailing-list
- FEDORA-2021-16c9c40d4d vendor-advisory
- GLSA-202107-30 vendor-advisory