Skip to main content

Citrix Releases Security Updates for Hypervisor

Scheduled updates for Citrix Hypervisor

Threat ID:
CC-4014
Threat Severity:
Information only
Published:
17 January 2022 1:04 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Scheduled updates for Citrix Hypervisor

Affected platforms

The following platforms are known to be affected:

Versions: all supported

Citrix Hypervisor

Versions: all prior to 7.1 LTSR CU2

Citrix XenServer

Threat details

Introduction

Citrix has released security updates to address vulnerabilities in Hypervisor. An attacker could exploit these vulnerabilities to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review Citrix Security Update CTX335432 and install the relevant hotfixes. 

NOTE: there are two hot fixes for each of the following: 

  • Citrix Hypervisor 8.2 CU1 LTSR: (CTX338448 and CTX335882)
  • Citrix Hypervisor 8.2: (CTX338444 and CTX335880 )
  • Citrix XenServer 7.1 LTSR CU2: (CTX335531 and CTX335881)

Remediation steps

Type Step
Patch

Hotfix XS82ECU1001 - For Citrix Hypervisor 8.2 Cumulative Update 1 
(Hotfix 1 of 2)


https://support.citrix.com/article/CTX338448
Patch

Hotfix XS82ECU1002 - For Citrix Hypervisor 8.2 Cumulative Update 1
(Hotfix 2 of 2)


https://support.citrix.com/article/CTX335882
Patch

Hotfix XS82E035 - For Citrix Hypervisor 8.2

(Hotfix 1 of 2)


https://support.citrix.com/article/CTX338444
Patch

Hotfix XS82E036 - For Citrix Hypervisor 8.2

(Hotfix 2 of 2)


https://support.citrix.com/article/CTX335880
Patch

Hotfix XS71ECU2069 - For XenServer 7.1 Cumulative Update 2

(Hotfix 1 of 2)


https://support.citrix.com/article/CTX335531
Patch

Hotfix XS71ECU2070 - For XenServer 7.1 Cumulative Update 2

(Hotfix 2 of 2)


https://support.citrix.com/article/CTX335881

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2021-28704

PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).
Status Published

CVE-2021-28705

issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error handling in certain PoD cases has been insufficient in that in particular partial success of some operations was not properly accounted for. There are two code paths affected - page removal (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix to both issues.)
Status Published

CVE-2021-28714

Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)
Status Published

CVE-2021-28715

Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)

Last edited: 17 January 2022 1:04 pm