MediumFix available
xen — security advisory
xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed on Arm.
- Products
- xen
- Affected versions
- Not specified
- Fixed versions
- 4.13.3-r1, 4.14.1-r3, 4.15.0-r1
- CVEs
- CVE-2021-28693
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:03 UTC · Revision 1
Source evidence
xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed on Arm.
osv:ALPINE-CVE-2021-28693
xen
Fixed versions: 4.13.3-r1
xen
Fixed versions: 4.13.3-r1
xen
Fixed versions: 4.14.1-r3
xen
Fixed versions: 4.15.0-r1
xen
Fixed versions: 4.15.0-r1
xen
Fixed versions: 4.15.0-r1
xen
Fixed versions: 4.15.0-r1
xen
Fixed versions: 4.15.0-r1
xen
Fixed versions: 4.15.0-r1
xen
Fixed versions: 4.15.0-r1
xen
Fixed versions: 4.15.0-r1
xen
Fixed versions: 4.15.0-r1
xen
Fixed versions: 4.15.0-r1
xen
Fixed versions: 4.15.0-r1
Complete source record
{
"id": "f4fdadebbefbfe42a762caf3cc723a48a7c0e399932594d2e8c8451bf8019e30",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-28693",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2021-28693",
"summary": "xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must \"scrub\" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed on Arm.",
"evidence": "osv:ALPINE-CVE-2021-28693",
"products": [
{
"name": {
"value": "xen",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.13.3-r1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.13.3-r1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.14.1-r3",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.0-r1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.0-r1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.0-r1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.0-r1",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.0-r1",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.0-r1",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.0-r1",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.0-r1",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.0-r1",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/12/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.0-r1",
"evidence": "/affected/12/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/13/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.0-r1",
"evidence": "/affected/13/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "ALPINE-CVE-2021-28693",
"aliases": [
"ALPINE-CVE-2021-28693"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.13.3-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.11"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.13.3-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.12"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.14.1-r3"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.13"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.15.0-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.14"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.15.0-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.15.0-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.15.0-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.15.0-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.15.0-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.15.0-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.15.0-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.15.0-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.15.0-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "4.15.0-r1"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-28693.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-23T17:17:56.172885405Z",
"provider": "osv",
"upstream": [
"CVE-2021-28693"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2021-28693"
]
},
"related_cves": [
{
"value": "CVE-2021-28693",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 415388,
"published_at": "2021-06-30T11:15:08.117+00:00"
}