CVE-2021-28697

grant table v2 status pages may remain accessible after de-allocation Guest
get permitted access to certain Xen-owned pages of memory. The majority of
such pages remain allocated / associated with a guest for its entire
lifetime. Grant table v2 status pages, however, get de-allocated when a
guest switched (back) from v2 to v1. The freeing of such pages requires
that the hypervisor know where in the guest these pages were mapped. The
hypervisor tracks only one use within guest space, but racing requests from
the guest to insert mappings of these pages may result in any of them to
become mapped in multiple locations. Upon switching back from v2 to v1, the
guest would then retain access to a page that was freed and perhaps re-used
for other purposes.

Notes