CVE-2021-28689

x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not architecturally protect ring 0 from predictions learnt in ring 1. For more details, see: https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-speculation Similar situations may exist with other mitigations for other kinds of speculative execution attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to be discovered, disclosed, or mitigated.

• CWE-212

• https://xenbits.xenproject.org/xsa/advisory-370.txtVendor Advisory
• https://xenbits.xenproject.org/xsa/advisory-370.txtVendor Advisory

Published

Jun 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28683An issue was discovered in Envoy through 1.71.1. There is a …7.5
• CVE-2021-28684The XML parser used in ConeXware PowerArchiver before 20.10.…4.3
• CVE-2021-28685AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3…7.8
• CVE-2021-28686AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3…5.5
• CVE-2021-28687HVM soft-reset crashes toolstack libxl requires all data str…5.5
• CVE-2021-28688The fix for XSA-365 includes initialization of pointers such…6.5
• CVE-2021-28690x86: TSX Async Abort protections not restored after S3 This …6.5
• CVE-2021-28691Guest triggered use-after-free in Linux xen-netback A malici…7.8
• CVE-2021-28692inappropriate x86 IOMMU timeout detection / handling IOMMUs …7.1
• CVE-2021-28693xen/arm: Boot modules are not scrubbed The bootloader will l…5.5
• CVE-2021-28694IOMMU page mapping issues on x86 T[his CNA information recor…6.8
• CVE-2021-28695IOMMU page mapping issues on x86 T[his CNA information recor…6.8