QID 377772

QID 377772: Citrix XenServer Security Updates (CTX460064)

A security issue has been identified in Citrix Hypervisor 7.1 LTSR CU2 that may allow privileged code in a PV guest VM to compromise the host. Citrix believes that there would be significant complexity in performing this attack in Citrix Hypervisor. The issue has the following CVE identifier: CVE-2022-26362 In addition Intel has disclosed several issues that affect CPU hardware and may allow code inside a guest VM to access very small sections of memory data that are actively being used elsewhere on the system. Although this is not an issue in the Citrix Hypervisor product itself, Citrix is releasing hotfixes that include product changes to mitigate these CPU issues. These issues have the following CVE identifiers: CVE-2022-21123 CVE-2022-21125 CVE-2022-21127 CVE-2022-21166

Affected Versions:
Citrix XenServer 7.1 CU2 LTSR Note: This QID will detect only for Citrix XenServer 7.1 LTSR

QID Detection Logic (Authenticated):
OS:Citrix XenServer
The QID checks if Hotfixes is applied on the vulnerable versions of Citrix XenServer.

Vulnerable version may allow a privileged code in a PV guest VM compromise the host. Vulnerable version may also allow code inside a guest VM to access very small sections of memory data that are actively being used elsewhere on the system.

  • CVSS V3 rated as High - 6.4 severity.
  • CVSS V2 rated as High - 6.9 severity.
    • Solution

    Hotfixes have been released for Citrix XenServer to address these issues. Refer to CTX460064 to obtain more information.

    Vendor References

    CVEs related to QID 377772

    CVE-2022-26362 | CVE-2022-21123 | CVE-2022-21125 | CVE-2022-21127 | CVE-2022-21166 |
    Software Advisories
    Advisory ID Software Component Link
    CTX460064 URL Logo support.citrix.com/article/CTX460064/citrix-hypervisor-security-update
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].