Xen on x86 - speculative vulnerabilities with bare 32-bit PV guests: MULTI-TENANT ISOLATION: Bare (non-shim) 32-bit PV

CVE-2021-28689Kernel, userspace & hypervisorcurated

Impact

MULTI-TENANT ISOLATION: Bare (non-shim) 32-bit PV guests run in ring 1, an arrangement that leaves them exposed to speculative-execution attacks against the hypervisor and other guests. Listed here because the mitigation story on AMD hardware differs from Intel's and gets overlooked - if you still run 32-bit PV guests anywhere, this is a standing cross-guest speculative exposure.

Who can reach it

From inside a 32-bit PV guest.

What to do

Fixed in Xen (XSA-370) by running 32-bit PV guests under the PV shim rather than bare. Update Xen, switch affected guests to shim mode, and reboot. The durable answer is to stop running 32-bit PV guests at all - on a modern AI fleet there is no reason to have any.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-28689 https://xenbits.xen.org/xsa/advisory-370.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.