=====================================================================

                                 CERT-Renater

                      Note d'Information No. 2022/VULN374

_____________________________________________________________________

DATE                : 12/10/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Citrix Hypervisor versions
                                  8.2 LTSR CU1.

=====================================================================
https://support.citrix.com/article/CTX465146/citrix-hypervisor-security-bulletin-for-cve202233748-cve202233749
_____________________________________________________________________


Citrix Hypervisor Security Bulletin for CVE-2022-33748 &
CVE-2022-33749

Reference: CTX465146
Category : Medium
Created  : 11 October 2022
Modified : 11 October 2022

Applicable Products

   o Citrix Hypervisor

Description of Problem

Several security issues have been identified in Citrix Hypervisor
8.2 LTSR CU1.

These are:

A malicious privileged user in a guest VM working in collaboration
with a malicious privileged user in another guest VM can cause the
host to crash or become unresponsive.
This issue has the following CVE identifier:

   o CVE-2022-33748

A malicious unauthenticated user on the management network may be
able to cause the management service on the host to crash or
become unresponsive.

This issue has the following CVE identifier:

   o CVE-2022-33749

Some recent Intel CPUs execute certain instructions with data
operand dependent timing that may allow an attacker to perform a
timing-based side-channel attack. The update described below enables
data operand independent timing on those CPUs.


What Customers Should Do

Citrix has released hotfixes to address these issues. Citrix
recommends that affected customers install these hotfixes as
their patching schedule allows.
The hotfixes can be downloaded from the following locations:
Citrix Hypervisor 8.2 LTSR CU1: CTX465169 - 
https://support.citrix.com/article/
CTX465169 and CTX466065 - https://support.citrix.com/article/CTX466065


What Citrix is Doing

Citrix is notifying customers and channel partners about this
potential security issue through the publication of this security
bulletin on the Citrix Knowledge Center at
https://support.citrix.com/securitybulletins .


Obtaining Support on This Issue

If you require technical assistance with this issue, please contact
Citrix Technical Support. Contact details for Citrix Technical Support
are available at https://www.citrix.com/support/open-a-support-case .


Subscribe to Receive Alerts

Citrix strongly recommends that all customers subscribe to receive alerts
when a Citrix security bulletin is created or modified at
https://support.citrix.com/user/alerts .


Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and
considers any and all potential vulnerabilities seriously. For
details on our vulnerability response process and guidance on how
to report security-related issues to Citrix, please see the following
webpage:
https://www.citrix.com/about/trust-center/vulnerability-process.html .


Disclaimer

This document is provided on an "as is" basis and does not imply
any kind of guarantee or warranty, including the warranties of
merchantability or fitness for a particular use. Your use of the
information on the document is at your own risk. Citrix reserves
the right to change or update this document at any time. Customers
are therefore recommended to always view the latest version of
this document directly from the Citrix Knowledge Center.


Changelog

Date       Change
2022-10-11 Initial Publication
2022-10-11 Spelling error corrected


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================