CVE-2021-28692

inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completion of such commands is not used. Instead, the issuing CPU spin-waits for the completion of the most recently issued command(s). Some of these waiting loops try to apply a timeout to fail overly-slow commands. The course of action upon a perceived timeout actually being detected is inappropriate: - on Intel hardware guests which did not originally cause the timeout may be marked as crashed, - on AMD hardware higher layer callers would not be notified of the issue, making them continue as if the IOMMU operation succeeded.

• CWE-269

• https://security.gentoo.org/glsa/202107-30Mitigation, Third Party Advisory
• https://xenbits.xenproject.org/xsa/advisory-373.txtVendor Advisory
• https://security.gentoo.org/glsa/202107-30Mitigation, Third Party Advisory
• https://xenbits.xenproject.org/xsa/advisory-373.txtVendor Advisory

Published

Jun 30, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28686AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3…5.5
• CVE-2021-28687HVM soft-reset crashes toolstack libxl requires all data str…5.5
• CVE-2021-28688The fix for XSA-365 includes initialization of pointers such…6.5
• CVE-2021-28689x86: Speculative vulnerabilities with bare (non-shim) 32-bit…5.5
• CVE-2021-28690x86: TSX Async Abort protections not restored after S3 This …6.5
• CVE-2021-28691Guest triggered use-after-free in Linux xen-netback A malici…7.8
• CVE-2021-28693xen/arm: Boot modules are not scrubbed The bootloader will l…5.5
• CVE-2021-28694IOMMU page mapping issues on x86 T[his CNA information recor…6.8
• CVE-2021-28695IOMMU page mapping issues on x86 T[his CNA information recor…6.8
• CVE-2021-28696IOMMU page mapping issues on x86 T[his CNA information recor…6.8
• CVE-2021-28697grant table v2 status pages may remain accessible after de-a…7.8
• CVE-2021-28698long running loops in grant table handling In order to prope…5.5