====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN373
_____________________________________________________________________

DATE                : 04/12/2017

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Citrix XenServer versions up to
                                     and including 7.2.

=====================================================================
https://support.citrix.com/article/CTX230138
_____________________________________________________________________

CTX230138

Citrix XenServer Multiple Security Updates

Security Bulletin | High | Created: 01 Dec 2017 | Modified: 01 Dec 2017

Applicable Products

    XenServer 7.2
    XenServer 7.1 LTSR Cumulative Update 1
    XenServer 7.1
    XenServer 7.0
    XenServer 6.5
    XenServer 6.2.0
    XenServer 6.0.2

Description of Problem

A number of security vulnerabilities have been identified in Citrix
XenServer that may allow a malicious administrator of an HVM guest VM
to compromise the host.

These vulnerabilities affect all currently supported versions of Citrix
XenServer up to and including Citrix XenServer 7.2.

The following vulnerabilities have been addressed:

    CVE-2017-7980: code execution via overflow in Cirrus Logic emulation
    CVE-2017-15592: Incorrect handling of self-linear shadow mappings
                     with translated guests
    CVE-2017-17044: Infinite loop due to missing PoD error checking
    CVE-2017-17045: Missing p2m error checking in PoD code

Mitigating Factors

Customers without HVM guests (i.e. PV guests only) are not affected by
these issues.

What Customers Should Do

Hotfixes have been released to address these issues. Citrix strongly
recommends that affected customers install these hotfixes as soon as
possible. The hotfixes can be downloaded from the following locations:

Citrix XenServer 7.2: CTX229541 –
https://support.citrix.com/article/CTX229541
and CTX230161 – https://support.citrix.com/article/CTX230161

Citrix XenServer 7.1 LTSR CU1: CTX229540 –
https://support.citrix.com/article/CTX229540 and CTX230160 –
https://support.citrix.com/article/CTX230160

Citrix XenServer 7.1 LTSR: CTX229545 –
https://support.citrix.com/article/CTX229545 and CTX230159 –
https://support.citrix.com/article/CTX230159

Citrix XenServer 7.0: CTX229539 –
https://support.citrix.com/article/CTX229539
and CTX229544 – https://support.citrix.com/article/CTX229544

Citrix XenServer 6.5 SP1: CTX229543 –
https://support.citrix.com/article/CTX229543

Citrix XenServer 6.2 SP1: CTX229096 –
https://support.citrix.com/article/CTX229096

Citrix XenServer 6.0.2 Common Criteria: CTX229095 –
https://support.citrix.com/article/CTX229095

Customers using the LivePatching feature of Citrix XenServer will not
need to reboot servers to apply this hotfix but HVM guest VMs must
either be rebooted or migrated to a server with the hotfix already
applied for the hotfix to be fully effective.

What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential
security issue. This article is also available from the Citrix
Knowledge Center at  http://support.citrix.com/.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact
Citrix Technical Support. Contact details for Citrix Technical Support
are available at
https://www.citrix.com/support/open-a-support-case.html.

Reporting Security Vulnerabilities

Citrix welcomes input regarding the security of its products and
considers any and all potential vulnerabilities seriously. For guidance
on how to report security-related issues to Citrix, please see the
following document:
CTX081743 – Reporting Security Issues to Citrix

Changelog
Date  			Change
1st December 2017 	Initial publishing


==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================