Citrix Hypervisor Security Update


A security issue has been identified in Citrix Hypervisor 7.1 LTSR CU2 that may allow privileged code in a PV guest VM to compromise the host. Citrix believes that there would be significant complexity in performing this attack in Citrix Hypervisor. The issue has the following CVE identifier: * CVE-2022-26362 In addition Intel has disclosed several issues that affect CPU hardware and may allow code inside a guest VM to access very small sections of memory data that are actively being used elsewhere on the system. Although this is not an issue in the Citrix Hypervisor product itself, Citrix is releasing hotfixes that include product changes to mitigate these CPU issues. These issues have the following CVE identifiers: * CVE-2022-21123 * CVE-2022-21125 * CVE-2022-21127 * CVE-2022-21166 Customers who are not running PV guest VMs are not affected by the Citrix Hypervisor issue. Customers who are not using Intel CPUs are not affected by the Intel CPU issues.