Description of Problem
A security issue has been identified in Citrix Hypervisor 7.1 LTSR CU2 that may allow privileged code in a PV guest VM to compromise the host. Citrix believes that there would be significant complexity in performing this attack in Citrix Hypervisor.
The issue has the following CVE identifier:
- CVE-2022-26362
In addition Intel has disclosed several issues that affect CPU hardware and may allow code inside a guest VM to access very small sections of memory data that are actively being used elsewhere on the system. Although this is not an issue in the Citrix Hypervisor product itself, Citrix is releasing hotfixes that include product changes to mitigate these CPU issues.
These issues have the following CVE identifiers:
- CVE-2022-21123
- CVE-2022-21125
- CVE-2022-21127
- CVE-2022-21166
Customers who are not using Intel CPUs are not affected by the Intel CPU issues.
What Customers Should Do
Citrix has released hotfixes to address this issue. Citrix recommends that affected customers install these hotfixes as their patching schedule allows. The hotfixes can be downloaded from the following locations:
Citrix Hypervisor 8.2 CU1 LTSR: CTX459954– https://support.citrix.com/article/CTX459954
Citrix XenServer 7.1 CU2 LTSR: CTX459953– https://support.citrix.com/article/CTX459953
What Citrix is Doing
Obtaining Support on This Issue
Subscribe to Receive Alerts
Reporting Security Vulnerabilities to Citrix
Disclaimer
Changelog
| Date | Change |
| 2022-06-23 | Initial Publication |