=====================================================================

                             CERT-Renater

                   Note d'Information No. 2021/VULN074
_____________________________________________________________________

DATE                : 10/02/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Citrix Hypervisor, XenServer.

=====================================================================
https://support.citrix.com/article/CTX337526
_____________________________________________________________________

Security Advisory for Citrix Hypervisor

Reference: CTX337526
Category : Medium
Created  : 07 February 2022
Modified : 08 February 2022

Applicable Products

   o Citrix Hypervisor
   o XenServer

Description of Problem

Several security issues have been identified that affect Citrix Hypervisor:
An issue has been identified that may allow privileged code in a
PV guest VM to cause the host to crash. This issue has the
following identifier:

   o CVE-2022-23034

Note that PV guests are supported in Citrix XenServer 7.1 LTSR but
are not supported in Citrix Hypervisor 8.2 LTSR. Customers who have
not deployed PV guests are not affected by CVE-2022-23034.

An issue has been identified that may allow privileged code in a
guest VM to cause the host to crash. This issue only affects systems
where the malicious guest VM has had a physical PCI device assigned
through to it by the host administrator using the PCI passthrough
feature. This issue has the following identifier:

   o CVE-2022-23035

Customers who have not assigned a physical PCI device to a guest VM
are not affected by CVE-2022-23035.

Intel has disclosed an issue that affects Intel CPU hardware together
with corresponding microcode updates. Although this is not an issue in
the Citrix Hypervisor product itself, Citrix is releasing hotfixes that
include the updated microcode together with the product changes needed
to support the new microcode. This issue has the following identifier:

   o CVE-2021-0145

Customers who are running on systems with only AMD CPUs are not affected
by the Intel CPU issue.


What Customers Should Do

Citrix has released hotfixes to address these issues. Citrix recommends
that affected customers install these hotfixes as their patching
schedule allows.
The hotfixes can be downloaded from the following locations:
Citrix Hypervisor 8.2 CU1 LTSR: CTX338451 -
https://support.citrix.com/article/CTX338451
Citrix Hypervisor 8.2: CTX338452 -
https://support.citrix.com/article/CTX338452
Citrix XenServer 7.1 CU2 LTSR: CTX338453 -
https://support.citrix.com/article/CTX338453


What Citrix is Doing

Citrix is notifying customers and channel partners about this potential
security issue through the publication of this security bulletin on the
Citrix Knowledge Center at https://support.citrix.com/securitybulletins .


Obtaining Support on This Issue

If you require technical assistance with this issue, please contact
Citrix Technical Support. Contact details for Citrix Technical Support
are available
at https://www.citrix.com/support/open-a-support-case .


Subscribe to Receive Alerts

Citrix strongly recommends that all customers subscribe to receive
alerts when a Citrix security bulletin is created or modified at
https://support.citrix.com/user/alerts .


Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and
considers any and all potential vulnerabilities seriously. For
details on our vulnerability response process and guidance on
how to report security-related issues to Citrix, please see
the following webpage:
https://www.citrix.com/about/trust-center/vulnerability-process.html .


Disclaimer

This document is provided on an "as is" basis and does not imply
any kind of guarantee or warranty, including the warranties of
merchantability or fitness for a particular use. Your use of the
information on the document is at your own risk. Citrix reserves
the right to change or update this document at any time. Customers
are therefore recommended to always view the latest version of
this document directly from the Citrix Knowledge Center.


Changelog

Date       Change
2022-02-08 Initial Publication

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================