XCP-ng
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    XSA-468: multiple Windows PV driver vulnerabilities - update now!

    Scheduled Pinned Locked Moved News
    60 Posts 14 Posters 3.5k Views 10 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D Offline
      DustinB @manilx
      last edited by

      @manilx said in XSA-468: multiple Windows PV driver vulnerabilities - update now!:

      @DustinB Did run usr/bin/create-guest-templates but tepmlates are gone here also.

      I did not, I'm in the middle of an AV/EDR migration and this way added to the list of things to touch while I was on the systems.

      To me the templates are a minor inconvenience as we aren't constantly adding VMs.

      1 Reply Last reply Reply Quote 0
      • C Offline
        conitrade-as @DustinB
        last edited by

        @DustinB Not IP assignments, I am talking about static routes. See e.g. https://learn.microsoft.com/en-us/powershell/module/nettcpip/get-netroute

        D 1 Reply Last reply Reply Quote 0
        • D Offline
          DustinB @conitrade-as
          last edited by

          @conitrade-as said in XSA-468: multiple Windows PV driver vulnerabilities - update now!:

          @DustinB Not IP assignments, I am talking about static routes. See e.g. https://learn.microsoft.com/en-us/powershell/module/nettcpip/get-netroute

          Okay.... what...

          1 Reply Last reply Reply Quote 0
          • pdoniasP Offline
            pdonias Vates 🪐 XO Team @DustinB
            last edited by pdonias

            Hi! Regarding the templates issue, we're working on a fix on branch pierre-fix-xsa468-test master. Would anyone having the issue be available to test it?

            C 1 Reply Last reply Reply Quote 0
            • C Offline
              conitrade-as @pdonias
              last edited by

              @pdonias Sure thing. I can test it in my test environment.

              1 Reply Last reply Reply Quote 1
              • C Offline
                conitrade-as @conitrade-as
                last edited by

                Just did a couple more tests. Here are my findings:

                • Upgrading the tools from v9.3.3 to v9.4.1 does preserve the routing table.
                • Upgrading the tools from v9.2.1 to v9.4.1 does not preserve the routing table.

                Here are a couple of powershell commands used for testing:

                Get-NetRoute -PolicyStore PersistentStore
Get-NetAdapter
New-NetRoute -DestinationPrefix "10.10.0.0/24" -InterfaceIndex <ifIndex> -NextHop 10.10.0.254
                D 1 Reply Last reply Reply Quote 0
                • D Offline
                  dinhngtu Vates 🪐 XCP-ng Team @conitrade-as
                  last edited by dinhngtu

                  @conitrade-as This is a known issue when upgrading from XS WinPV 9.3.0 and below: https://support.citrix.com/s/article/CTX235403-updates-to-xenserver-vm-tools-for-windows-for-xenserver-and-citrix-hypervisor

                  C 1 Reply Last reply Reply Quote 0
                  • C Offline
                    conitrade-as @dinhngtu
                    last edited by

                    @dinhngtu Thanks for the pointer. Yes, it seems that the root cause also makes routes disappear. Howerver, that the routing information is gone is sadly not mentioned explicitly. May be something to add to your docs as well.

                    Caution when updating tools: Verify interface IP configuration and routing entries.

                    1 Reply Last reply Reply Quote 0
                    • stormiS Offline
                      stormi Vates 🪐 XCP-ng Team @Forza
                      last edited by

                      @Forza said in XSA-468: multiple Windows PV driver vulnerabilities - update now!:

                      Hi,

                      It is not clear to me if the old XCP-ng PV drivers (8.2.2.200-RC1) are affected or not. How should we proceed if they are?

                      Do others share this feeling and have this question after re-reading the whole announcement?

                      D 1 Reply Last reply Reply Quote 0
                      • D Offline
                        DustinB @stormi
                        last edited by

                        @stormi said in XSA-468: multiple Windows PV driver vulnerabilities - update now!:

                        Do others share this feeling and have this question after re-reading the whole announcement?

                        No it's pretty clear, update the drivers on everything as all versions are susceptible.

                        1 Reply Last reply Reply Quote 2
                        • F Offline
                          flakpyro @conitrade-as
                          last edited by

                          @dinhngtu

                          One thing i've noticed since upgrading to tools version 9.4.1 is that the version installed will display properly in XOA up until the VM is migrated. After a migration it changed to just "Management agent detected" with no version shown. Not sure if this is an XO issue or an issue with the tools itself?

                          stormiS A 2 Replies Last reply Reply Quote 0
                          • stormiS Offline
                            stormi Vates 🪐 XCP-ng Team @flakpyro
                            last edited by stormi

                            @flakpyro There's also a chance this is a XAPI issue. CC @andriy.sultanov

                            D 1 Reply Last reply Reply Quote 0
                            • D Offline
                              dinhngtu Vates 🪐 XCP-ng Team @stormi
                              last edited by

                              @flakpyro What do you get from this command?

                              xe vm-param-get uuid=<uuid> param-name=PV-drivers-version

                              @stormi It sounds like the issue we encountered in CI with the management agent not restoring version numbers after migration.

                              F 1 Reply Last reply Reply Quote 0
                              • F Offline
                                flakpyro @dinhngtu
                                last edited by

                                @dinhngtu here is the output from one of the VMs recently migrated:

                                xe vm-param-get uuid=261634d9-b67c-1048-b028-2e33abea6329 param-name=PV-drivers-version
micro: -1; xennet: XenServer 9.1.7.65 ; xeniface: XenServer 9.1.12.94 ; xenvif: XenServer 9.1.13.107 ; xenvbd: XenServer 9.1.9.82 ; xenbus: XenServer 9.1.11.115
                                1 Reply Last reply Reply Quote 1
                                • A Offline
                                  archw @flakpyro
                                  last edited by

                                  @flakpyro
                                  I've found a similar issue with all VMs I update. After I update and reboot, it stays at "Management agent detected" with no version shown.

                                  Once I reboot a second time, it stays at "Management agent detected" with "Management agent 9.4.1-160 detected"

                                  C 1 Reply Last reply Reply Quote 0
                                  • C Offline
                                    conitrade-as @archw
                                    last edited by

                                    @archw I can confirm. That is exactly the behaviour I see with my Windows VMs.

                                    1 Reply Last reply Reply Quote 0
                                    • T Offline
                                      TrapoSAMA
                                      last edited by

                                      HI!

                                      Upgrade Xentools take two reboot for complete! if you have old tools installed isbetter upgrade to 7 and after to 9

                                      About this last somebody have some issue upgrading windows server 2012R2?

                                      Thx

                                      D 1 Reply Last reply Reply Quote 0
                                      • D Offline
                                        dinhngtu Vates 🪐 XCP-ng Team @TrapoSAMA
                                        last edited by

                                        @TrapoSAMA Windows Server 2012/2012R2 are no longer supported by our (XCP-ng) drivers nor by XenServer drivers.

                                        T Tristis OrisT 2 Replies Last reply Reply Quote 0
                                        • T Offline
                                          TrapoSAMA @dinhngtu
                                          last edited by

                                          @dinhngtu

                                          hi!! normally install Xen drivers not XCP driver yet. Some experience with this issue when install over 2012r2?

                                          Thx

                                          1 Reply Last reply Reply Quote 0
                                          • Tristis OrisT Offline
                                            Tristis Oris Top contributor @dinhngtu
                                            last edited by

                                            @dinhngtu Great. So or forever get that banner about vulnerability, or install new tools=no tools, no migration, no pool upgrade, etc.
                                            Need a option "i don't care, hide this host".

                                            stormiS 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post