Citrix Hypervisor Security Update

Several security issues have been identified that affect Citrix Hypervisor:

Two issues, each of which may each allow privileged code in a guest VM to cause the host to crash or become unresponsive. These two issues only affect systems where the malicious guest VM has a physical PCI device passed through to it by the host administrator.

These issues have the following identifiers:

• CVE-2021-27379
• CVE-2021-28692

A further issue that affects underlying CPU hardware. Although this is not an issue in the Citrix Hypervisor product itself, Citrix is releasing hotfixes that also address this CPU issue. This issue is of a type known as “speculative execution attacks” and may allow malicious code running on a CPU to infer the value of registers or memory belonging to other processes running on that CPU.

This issue has the following identifiers:

• CVE-2021-0089 (Intel CPUs)/CVE-2021-26313 (AMD CPUs)
  CVE ID| Description| Pre-conditions
  —|—|—
  CVE-2021-27379| privileged code in a guest VM may cause the host to crash or become unresponsive| malicious guest VM must have a physical PCI device passed through by the host administrator and the attacker must be able to execute privileged code
  CVE-2021-28692| privileged code in a guest VM may cause the host to crash or become unresponsive| malicious guest VM must have a physical PCI device passed through by the host administrator and the attacker must be able to execute privileged code
  CVE-2021-0089/CVE-2021-26313| malicious code running on a CPU could infer the value of registers or memory belonging to other processes running on that CPU| Ability to execute code in a guest VM