February 2022 Security Update

Samuel Verschelde -

A security update is available for the only currently supported release of XCP-ng: 8.2 LTS.

📔
To update, follow this guide. You can also join the discussion on our community forum. Hosts reboot necessary after this update.

Summary

Several vulnerabilities have been discovered and fixed in Xen.

To address this, we released updates for this component in XCP-ng.

Hardware vulnerabilities in Intel CPUs were also disclosed by Intel. This update includes the new microcode they released to address this.

Impact

Due to the vulnerabilities in Xen:

  • privileged code in a PV VM may cause the host to crash ;
  • privileged code in a VM using PCI passthrough may cause the host to crash.

Regarding Intel's microcode update, the main fix that might matter in the context of XCP-ng is related to the information disclosure made possible by the vulnerabilities in the affected CPUs. Other flaws fixed by the update are described in Red Hat's report referenced below.

References