Citrix product family (Citrix Hypervisor, Citrix Virtual Apps and Desktops, etc.) security update recommendations

Mar 08 2024

Overview

An update has been made available to fix vulnerabilities in the Citrix family of products. users of affected versions are advised to update to the latest version.

Affected Products

CVE-2022-40982 occurs when running on Intel CPUs with Skylake Server, Coffee Lake Server, Cooper Lake Server, or Ice Lake Server microarchitectures
CVE-2023-20569 occurs when running on AMD CPUs with Zen 3 or Zen 4 microarchitectures
CVE-2023-23583 occurs when running on Intel Ice Lake at least CPUs
CVE-2023-46835 when running on AMD CPUs with PCI devices forwarded to the guest VM by the host administrator

Cve-2022-3643, cve-2022-42328, cve-2022-42329, cve-2023-20569, cve-2023-34319, cve-2022-40982, cve-2023-20593

Citrix Hypervisor 8.2 LTSR CU1

CVE-2023-6184

Citrix Virtual Apps and Desktops versions prior to 2311
Citrix Virtual Apps and Desktops 1912 LTSR CU8 hotfix 19.12.8100.4 prior to 19.12.8100.4
Citrix Virtual Apps and Desktops 2203 LTSR CU4 and earlier

CVE-2023-20593

Citrix Hypervisor running on AMD Zen 2 CPUs

CVE-2023-5914

Citrix StoreFront prior to 2308.1
Citrix StoreFront prior to 2311
Citrix StoreFront prior to 1912 LTSR CU8 hotfix 3.22.8001.2
Citrix StoreFront prior to 2203 LTSR CU4 Update 1

Cve-2023-24487, cve-2023-24488

Citrix ADC and Citrix Gateway 13.1 versions prior to 13.1-45.61
Citrix ADC and Citrix Gateway 13.0 versions prior to 13.0-90.11
Citrix ADC and Citrix Gateway 12.1 versions prior to 12.1-65.35
Citrix ADC prior to 12.1-FIPS 12.1-55.296
Citrix ADC prior to 12.1-NDcPP 12.1-55.296

Cve-2023-23583, cve-2023-46835

Citrix Hypervisor 8.2 CU1 LTSR

CVE-2023-24490

Citrix Virtual Apps and Desktops prior to 2305
Citrix Virtual Apps and Desktops prior to 2203 LTSR CU3
Citrix Virtual Apps and Desktops prior to 1912 LTSR CU7
Linux Virtual Delivery Agent prior to 2305
Linux Virtual Delivery Agent prior to 2203 LTSR CU3
Linux Virtual Delivery Agent prior to 1912 LTSR CU7 hotfix 1 (19.12.7001)

CVE-2023-46838

Citrix Hypervisor 8.2 CU1 LTSR

Cve-2023-6548, cve-2023-6549

NetScaler ADC and NetScaler Gateway 14.1 prior to 14.1-12.35
NetScaler ADC and NetScaler Gateway 13.1 prior to 13.1-51.15
NetScaler ADC and NetScaler Gateway 13.0 prior to 13.0-92.21
NetScaler ADC 13.1-FIPS versions on prior to 13.1-37.176
NetScaler ADC 12.1-FIPS versions on prior to 12.1-55.302
12.1-NDcPP versions prior to NetScaler ADC 12.1-55.302

Resolved Vulnerabilities

Denial of Service Vulnerability due to a use-after-free vulnerability in the Xen netback driver in the Linux kernel (CVE-2022-3643)

Deadlock vulnerability in the Xen netback driver in the Linux kernel (CVE-2022-42328, CVE-2022-42329)

Return address prediction vulnerability due to a side channel vulnerability in some AMD CPUs (CVE-2023-20569)

Driver buffer overrun vulnerability due to malformed packets in XSA-423 (CVE-2023-34319)

Information disclosure vulnerability in the microarchitecture state after transient execution on certain vector execution devices for some Intel(R) processors (CVE-2022-40982)

Arbitrary code execution vulnerability in Citrix Virtual Apps and Desktops (CVE-2023-6184)

Sensitive information access vulnerability due to an issue in the Zen 2 CPU (CVE-2023-20593)

XSS vulnerability in Citrix StoreFront (CVE-2023-5914)

XSS vulnerability in Citrix ADC and Citrix Gateway (CVE-2023-24488)

Arbitrary File Read Vulnerability in Citrix ADC and Citrix Gateway (CVE-2023-24487)

Vulnerability that could cause unexpected behavior in some Intel(R) processors due to the order of processor instructions (CVE-2023-23583)

A data leakage vulnerability due to an isolation page table level inconsistency where the sink page from which devices gain read/write access is no longer cleared at least between device allocations (CVE-2023-46835)

Vulnerability that could allow a user with only permission to run VDA applications to run an unauthorized desktop (CVE-2023-24490)

Host crash or unresponsiveness vulnerability due to malicious privileged code in a guest VM (CVE-2023-46838)

Authenticated remote code execution vulnerability in NetScaler ADCs and NetScaler Gateways due to improper controls over code injection, allowing an attacker to gain access to NSIP, CLIP, or SNIP with management interfaces (CVE-2023-6548)

Unauthenticated denial of service vulnerability in NetScaler ADC and NetScaler Gateway (CVE-2023-6549)

Vulnerability Patches

vulnerability Patches have been made available in the latest updates. Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version.

Cve-2022-3643, cve-2022-42328, cve-2022-42329

Citrix Hypervisor 8.2 LTSR CU1: CTX476080

Cve-2023-20569, cve-2023-34319, cve-2022-40982

Citrix Hypervisor 8.2 LTSR CU1: CTX564360
Citrix Hypervisor 8.2 LTSR CU1: CTX569269
Citrix Hypervisor 8.2 LTSR CU1: CTX570473