A security issue has been identified in Citrix Hypervisor 7.1 LTSR CU2 that may allow privileged code in a PV guest VM to compromise the host.  Citrix believes that there would be significant complexity in performing this attack in Citrix Hypervisor.

The issue has the following CVE identifier:

• CVE-2022-26362

In addition Intel has disclosed several issues that affect CPU hardware and may allow code inside a guest VM to access very small sections of memory data that are actively being used elsewhere on the system.  Although this is not an issue in the Citrix Hypervisor product itself, Citrix is releasing hotfixes that include product changes to mitigate these CPU issues.

These issues have the following CVE identifiers:

• CVE-2022-21123
• CVE-2022-21125
• CVE-2022-21127
• CVE-2022-21166

Instructions

Citrix has released hotfixes to address this issue. Citrix recommends that affected customers install these hotfixes as their patching schedule allows.  The hotfixes can be downloaded from the following locations:

Citrix Hypervisor 8.2 CU1 LTSR: CTX459954– https://support.citrix.com/article/CTX459954
Citrix XenServer 7.1 CU2 LTSR: CTX459953– https://support.citrix.com/article/CTX459953