CVE-2021-28700

Name	CVE-2021-28700
Description	xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the memory limit from them is not set. This allow a domain to allocate memory beyond what an administrator originally configured.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DSA-4977-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xen (PTS)	buster, buster (security)	4.11.4+107-gef32c7afa2-1	fixed
	bullseye (security), bullseye	4.14.5+94-ge49571868d-1	fixed
	bookworm, sid	4.17.1+2-gb773c48e36-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
xen	source	stretch	(not affected)
xen	source	buster	(not affected)
xen	source	bullseye	4.14.3-1~deb11u1	DSA-4977-1
xen	source	(unstable)	4.14.3-1

Notes

[buster] - xen <not-affected> (Only affects 4.12 and later)
[stretch] - xen <not-affected> (Only affects 4.12 and later)
https://xenbits.xen.org/xsa/advisory-383.html