Skip to main content

Citrix Releases Security Update for Hypervisor

Security update addresses three vulnerabilities affecting Citrix Hypervisor

Threat ID:
CC-4234
Threat Severity:
Information only
Published:
22 December 2022 11:45 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security update addresses three vulnerabilities affecting Citrix Hypervisor

Affected platforms

The following platforms are known to be affected:

Versions: 8.2 LTSR CU1

Citrix Hypervisor

Threat details

Introduction

Citrix has released a security update to address three vulnerabilities affecting Citrix Hypervisor. These vulnerabilities may allow a privileged user in a guest VM to cause the host to become unresponsive or crash. An attacker could exploit some of these vulnerabilities to carry out a denial-of-service (DoS) attack.

Remediation advice

Affected organisations are encouraged to review Citrix Security Bulletin CTX476080 and apply the relevant updates.

Remediation steps

Type Step
Patch

Citrix Hypervisor | Hotfix XS82ECU1024


https://support.citrix.com/article/CTX476080/hotfix-xs82ecu1024-for-citrix-hypervisor-82-cumulative-update-1

CVE Vulnerabilities

Status Published

CVE-2022-3643

Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior.
Status Published

CVE-2022-42328

Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).
Status Published

CVE-2022-42329

Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).

Last edited: 22 December 2022 3:23 pm