Citrix Releases Security Update for Hypervisor

Threat ID:: CC-3809
Threat Severity:: Information only
Published:: 1 April 2021 11:53 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Affected platforms

The following platforms are known to be affected:

Versions: 7.1 LTSR CU2

Citrix XenServer

Versions: 7.0

Citrix XenServer

The following platforms are also known to be affected:

Citrix Hypervisor Versions: 8.2 LTSR and earlier

Threat details

Introduction

Citrix has released security updates to address vulnerabilities in Citrix Hypervisor (formerly Citrix XenServer) that may allow privileged code in a guest virtual machine to cause the host to crash or become unresponsive. An attacker could exploit some of these vulnerabilities to cause a denial-of-service condition.

Remediation advice

Affected organisations are encouraged to review Citrix Hypervisor Security Update page and install the relevant hotfixes.

Remediation steps

Type	Step
Patch	Citrix Hypervisor 8.2 LTSR: CTX306481 (Hotfix 1 of 2) https://support.citrix.com/article/CTX306481
Patch	Citrix Hypervisor 8.2 LTSR: CTX306423 (Hotfix 2 of 2) https://support.citrix.com/article/CTX306423
Patch	Citrix XenServer 7.1 LTSR CU2: CTX306480 https://support.citrix.com/article/CTX306480
Patch	Citrix XenServer 7.0: CTX306482 https://support.citrix.com/article/CTX306482

CVE Vulnerabilities

Status Published

CVE-2021-28038

An attacker with the ability to execute privileged mode code in a guest can perform a denial of service attack against the host.

CWE-400: Uncontrolled Resource Consumption

Prerequisite: Ability to run privileged code in a guest VM

Status Published

CVE-2021-28688

An attacker with the ability to execute privileged mode code in a guest can perform a denial of service attack against the host.

CWE-400: Uncontrolled Resource Consumption

Prerequisite: Ability to run privileged code in a guest VM

Status Reserved

CVE-2020-35498

Malicious network traffic on the local network may cause subsequent packets to be dropped

CWE-682: Incorrect Calculation

Prerequisite: Access to the local network

Last edited: 1 April 2021 1:42 pm