CVE-2021-28715: Linux Kernel Netback Driver DoS Flaw

CVE-2021-28715 Overview

CVE-2021-28715 is a Resource Exhaustion vulnerability in the Linux kernel's netback driver that allows a malicious guest to force the host system to consume excessive amounts of kernel memory. The vulnerability exists in how incoming data packets for a guest are buffered until the guest is ready to process them. While there are measures in place to prevent excessive data accumulation, a guest can bypass these protections to cause a denial of service condition on the host.

Critical Impact

A malicious guest VM can exploit this vulnerability to exhaust host kernel memory by accumulating gigabytes of data through UDP connections, potentially causing denial of service to the hypervisor and other guest VMs.

Affected Products

• Linux Linux Kernel (all vulnerable versions)
• Debian Linux 9.0
• Debian Linux 10.0
• Debian Linux 11.0

Discovery Timeline

• 2022-01-06 - CVE CVE-2021-28715 published to NVD
• 2025-05-22 - Last updated in NVD database

Technical Details for CVE-2021-28715

Vulnerability Analysis

The vulnerability resides in the Linux kernel's netback driver, which handles network traffic for Xen guest virtual machines. The driver buffers incoming packets for guests until they are ready to process them. The fundamental issue is that the protective timeout mechanism (defaulting to 60 seconds) can be bypassed or rendered ineffective.

There are two distinct attack scenarios covered by this advisory. In the first scenario (CVE-2021-28715), using a UDP connection on a fast interface can accumulate gigabytes of data within the 60-second timeout window before the guest is considered stalled. The related vulnerability CVE-2021-28714 describes how the timeout can be prevented from triggering entirely if the guest maintains only one free slot in its RX queue ring page while the next packet requires more than one slot (possible when using GSO, XDP, or software hashing).

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), as the driver fails to adequately limit the amount of kernel memory that can be consumed by buffered packets.

Root Cause

The root cause is improper resource allocation controls in the netback driver. The existing timeout mechanism that detects stalled guest interfaces is insufficient because:

1. The default 60-second timeout is too generous, allowing substantial data accumulation on fast network interfaces
2. The timeout logic can be completely bypassed by keeping the RX queue in a specific state where it appears active but cannot accept incoming packets
3. There are no hard limits on the total kernel memory that can be consumed by buffered packets per guest

Attack Vector

The attack requires local access from within a guest VM and targets the hypervisor's kernel memory. An attacker with control of a guest VM can initiate high-bandwidth UDP traffic to the guest interface while deliberately stalling packet processing. This causes the netback driver on the host to buffer all incoming packets in kernel memory. By maintaining this state for extended periods or preventing timeout detection entirely, an attacker can exhaust available kernel memory on the host system, affecting the hypervisor and all other guest VMs.

The attack mechanism involves manipulating the RX queue ring page to maintain exactly one free slot while receiving packets that require multiple slots (such as those using Generic Segmentation Offload, XDP, or software hashing). This prevents the timeout from ever triggering while data continues to accumulate.

Detection Methods for CVE-2021-28715

Indicators of Compromise

• Unusual kernel memory consumption on Xen hypervisor hosts without corresponding legitimate workload increases
• Degraded performance or instability affecting multiple guest VMs simultaneously
• Memory pressure warnings or OOM (Out of Memory) killer activation on the host system
• Network interfaces appearing stalled or unresponsive on guest VMs

Detection Strategies

• Monitor kernel memory usage trends on Xen hypervisor hosts, alerting on sustained increases without clear cause
• Track netback driver buffer utilization and queue depths for abnormal patterns
• Implement alerting for guest VMs with consistently high inbound network traffic but low packet processing rates
• Review system logs for netback driver warnings or errors related to buffer management

Monitoring Recommendations

• Deploy memory monitoring with baseline thresholds for kernel memory consumption on hypervisor hosts
• Configure network flow analysis to identify guests receiving high-volume UDP traffic
• Enable Xen-specific monitoring for guest interface queue statistics
• Implement automated alerting for memory exhaustion conditions on virtualization infrastructure

How to Mitigate CVE-2021-28715

Immediate Actions Required

• Apply the latest kernel security patches from your Linux distribution
• Review and apply the recommendations in Xen Project Advisory XSA-392
• Consider reducing the default stall timeout for guest interfaces if immediate patching is not possible
• Monitor memory consumption on hypervisor hosts while patches are being deployed

Patch Information

Security patches addressing this vulnerability are available through multiple channels. Debian users should apply the updates referenced in DSA-5050 and DSA-5096. Additional information is available in the Debian LTS announcements for older supported releases.

The Xen Project Advisory XSA-392 provides comprehensive details on the vulnerability and recommended mitigations. Users should update to patched kernel versions as provided by their distribution vendors.

Workarounds

• Limit network bandwidth available to untrusted guest VMs to reduce the rate of memory accumulation
• Reduce the netback driver timeout parameter from the default 60 seconds to a shorter interval
• Implement memory quotas or cgroups restrictions on Xen domains where possible
• Consider network traffic rate limiting at the hypervisor level for high-risk guest VMs
• Isolate sensitive workloads from untrusted guests on separate physical hosts until patches are applied

# Monitor kernel memory usage for early detection
watch -n 5 'cat /proc/meminfo | grep -E "^(MemTotal|MemFree|Slab|SReclaimable)"'

# Review netback driver status and queue information
dmesg | grep -i netback

# Check for memory pressure events
journalctl -k | grep -iE '(oom|memory|netback)'