CVE-2021-28699: 
NixOS vulnerability analysis and mitigation

CVE-2021-28699 is a vulnerability in the Xen hypervisor's grant table v2 interface that was discovered in 2021. The vulnerability affects Xen versions from 4.10 onwards, specifically impacting 32-bit x86 guests permitted to use grant table version 2 interfaces. The issue stems from inadequate grant-v2 status frames array bounds checking in the translation of requests for grant status table frame numbers (Xen Advisory).

The vulnerability occurs in the v2 grant table interface which separates grant attributes from grant status, creating two tables for guests. When 32-bit guests on x86 request frame numbers of the grant status table, translation is required due to differences between 32-bit and 64-bit interface structure layouts. While the translation layer specifies the array capacity within translation space, the core function only enforces array bounds to be below 8 times the specified value, potentially allowing writes beyond the available space when storing frame numbers. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a Denial of Service (DoS) attack affecting the entire system when exploited by malicious or buggy guest kernels. While the primary impact is system availability, privilege escalation and information leaks cannot be ruled out. The vulnerability specifically affects systems where guests are permitted to have 8177 or more grant table frames (Xen Advisory).

The vulnerability can be mitigated by limiting the number of grants Xen allows guests to establish, controlled by the 'gnttab_max_frames' Xen command line option and the 'max_grant_frames' xl domain configuration setting. From Xen 4.14 onwards, administrators can also modify the system-wide upper bound through the /params/gnttab_max_frames hypervisor file system node. Additionally, suppressing the use of grant table v2 interfaces for 32-bit x86 guests will prevent exploitation (Xen Advisory).

The vulnerability was addressed by multiple Linux distributions including Debian, Fedora, and Gentoo, which released security updates to patch affected versions. Citrix also released patches for their Hypervisor products to address this vulnerability along with several other security issues (SecurityWeek).