Citrix Releases Security Updates for Hypervisor

Security updates address two vulnerabilities affecting Citrix Hypervisor

Threat ID:: CC-4128
Threat Severity:: Information only
Published:: 13 July 2022 2:26 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security updates address two vulnerabilities affecting Citrix Hypervisor

Affected platforms

The following platforms are known to be affected:

Versions: Versions: all prior to 8.2 Cumulative Update 1

Citrix Hypervisor

Versions: all prior to 7.1 Cumulative update 2

Citrix XenServer

Threat details

Introduction

Citrix has released security updates to address two vulnerabilities affecting Citrix Hypervisor. An attacker could exploit these vulnerabilities to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review Citrix Security Update CTX461397 and apply the relevant updates.

Remediation steps

Type	Step
Patch	Citrix Hypervisor 8.2 CU1 LTSR \| CTX461352 https://support.citrix.com/article/CTX461352
Patch	Citrix XenServer 7.1 CU2 LTSR \| CTX461353 https://support.citrix.com/article/CTX461353

Definitive source of threat updates

CVE Vulnerabilities

Status Reserved

CVE-2022-23825

Status Published

CVE-2022-29900

AMD microprocessor families 15h to 18h are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.

Last edited: 13 July 2022 3:05 pm