Lucene search

K
citrixCitrixCTX284874
HistoryOct 27, 2020 - 4:00 a.m.

Citrix Hypervisor Security Update

2020-10-2704:00:00
support.citrix.com
57

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.0005 Low

EPSS

Percentile

15.9%

Description of Problem

Several security issues have been identified in Citrix Hypervisor (formerly Citrix XenServer) that may allow:

  • unprivileged code in a PV guest VM to compromise that PV guest VM
  • privileged code in a guest VM to cause the host to crash or become unresponsive
  • privileged code in an HVM guest VM, to which the host administrator has assigned a PCI passthrough device, to corrupt in-memory data of the host or other VMs and potentially cause the host to crash.

These issues have the following identifiers:

  • CVE-2020-27670
  • CVE-2020-27671
  • CVE-2020-27672
  • CVE-2020-27673
  • CVE-2020-27674
  • CVE-2020-27675

These issues affect all currently supported versions of Citrix Hypervisor up to and including Citrix Hypervisor 8.2 LTSR.

What Customers Should Do

Citrix has released hotfixes to address these issues. Citrix recommends that affected customers install these hotfixes as their patching schedule allows. The hotfixes can be downloaded from the following locations:

Citrix Hypervisor 8.2 LTSR: CTX283510 – <https://support.citrix.com/article/CTX283510&gt; and CTX283516 – <https://support.citrix.com/article/CTX283516&gt;

Citrix Hypervisor 8.1: CTX283509 – <https://support.citrix.com/article/CTX283509&gt; and CTX283515 – <https://support.citrix.com/article/CTX283515&gt;

Citrix XenServer 7.1 LTSR CU2: CTX283508 – <https://support.citrix.com/article/CTX283508&gt; and CTX283514 – <https://support.citrix.com/article/CTX283514&gt;

Citrix XenServer 7.0: CTX283507 – <https://support.citrix.com/article/CTX283507&gt; and CTX283512 – <https://support.citrix.com/article/CTX283512&gt;

What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential security issue. This article is also available from the Citrix Knowledge Center at _ <http://support.citrix.com/&gt;_.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at _ <https://www.citrix.com/support/open-a-support-case.html&gt;_.

Reporting Security Vulnerabilities

Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For details on our vulnerability response process and guidance on how to report security-related issues to Citrix, please visit the Citrix Trust Center at <https://www.citrix.com/about/trust-center/vulnerability-process.html&gt;.

Changelog

Date Change
2020-10-27 Initial Publication
2020-10-27 Corrected links to hotfixes

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.0005 Low

EPSS

Percentile

15.9%