vulnerability

VMware Photon OS: CVE-2021-28039

Try Surface Command

Back to search

Severity

CVSS

(AV:L/AC:L/Au:N/C:N/I:N/A:P)

Published

Mar 5, 2021

Added

Jan 20, 2025

Modified

Mar 25, 2026

Description

An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom0 or driver domain via a large amount of I/O activity. The issue relates to misuse of guest physical addresses when a configuration has CONFIG_XEN_UNPOPULATED_ALLOC but not CONFIG_XEN_BALLOON_MEMORY_HOTPLUG.

Solution

vmware-photon_os_update_tdnf

References

CVE-2021-28039
https://attackerkb.com/topics/CVE-2021-28039
CWE-131
EUVD-EUVD-2021-14746
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-14746

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report