====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN121
_____________________________________________________________________

DATE                : 26/02/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Citrix Hypervisor all versions.

=====================================================================
https://support.citrix.com/article/CTX296603
_____________________________________________________________________

Citrix Hypervisor Security Update

Reference: CTX296603
Category : Medium
Created  : 16 February 2021
Modified : 23 February 2021

Applicable Products

  o Citrix Hypervisor

Description of Problem

Several security issues have been identified that, collectively, may
allow privileged code running in a guest VM to cause the host to crash
or to become unresponsive.

These issues have the following CVE identifiers:


CVE ID         Description                       Vulnerability
Pre-conditions

                                                 Type
CVE-2021-26930
               An attacker with the ability to   CWE-664: Improper
Administrator
               execute privileged mode code in   Control of a
access in
               a guest can perform a denial of   Resource Through
guest
               service attack against the host   its Lifetime


CVE-2021-26931
               An attacker with the ability to   CWE-664: Improper
Administrator
               execute privileged mode code in   Control of a
access in
               a guest can perform a denial of   Resource Through
guest
               service attack against the host   its Lifetime


CVE-2021-26932
               An attacker with the ability to   CWE-664: Improper
Administrator
               execute privileged mode code in   Control of a
access in
               a guest can perform a denial of   Resource Through
guest
               service attack against the host   its Lifetime



All supported versions of Citrix Hypervisor are affected by these
issues.


What Customers Should Do

Citrix has released hotfixes to address these issue. Citrix recommends
that affected customers install these hotfixes as their patching
schedule allows.

The hotfixes can be downloaded from the following locations:

Citrix Hypervisor 8.2 LTSR: CTX294145 -
https://support.citrix.com/article/CTX294145

Citrix Hypervisor 7.1 LTSR: CTX294143 -
https://support.citrix.com/article/CTX294143

Citrix Hypervisor 7.0: CTX294141 -
https://support.citrix.com/article/CTX294141

Citrix is notifying customers and channel partners about this potential
security issue. This article is also available from the Citrix Knowledge
Center at . If you require technical assistance with this issue, please
contact Citrix Technical Support. Contact details for Citrix Technical
Support are available at . Citrix welcomes input regarding the security
of its products and considers any and all potential vulnerabilities
seriously. For details on our vulnerability response process and
guidance on how to report security-related issues to Citrix, please see
the following webpage: - This document is provided on an "as is" basis
and does not imply any kind of guarantee or warranty, including the
warranties of merchantability or fitness for a particular use.
Your use of the information on the document is at your own risk. Citrix
reserves the right to change or update this document at any time.


Changelog

Date       Change
2021-02-16 Initial Publication


Disclaimer

OBTAINING SUPPORT ON THIS ISSUE- If you require technical assistance
with this issue, please contact Citrix Technical Support. Contact
details for Citrix Technical Support are available at
https://www.citrix.com/support/
open-a-support-case.html . REPORTING SECURITY VULNERABILITIES- Citrix
welcomes input regarding the security of its products and considers any
and all potential vulnerabilities seriously. For guidance on how to
report security-related issues to Citrix, please see the following
document: CTX081743
- - Reporting Security Issues to Citrix.


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================