Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Hypervisor-Assisted Guest Mitigation for Branch Target injection (52085)

Last Updated: 11/8/2023Categories: InformationalTotal Views: 159845Language:
Chinese (Simplified)JapaneseEnglish

8 like this article

Subscribe to get an email
newsletter with new updates

8 people found this helpful Please provide article feedback:

Purpose

Update: The Hypervisor-Assisted Guest Mitigation process described in KB 55111, is cumulative and will also mitigate the issues described in this article.

Recent microcode updates by Intel and AMD provide hardware support for branch target injection mitigation (Spectre v2). In order to use this new hardware feature within virtual machines, Hypervisor-Assisted Guest Mitigation must be enabled.

This document will focus on Hypervisor-Assisted Guest Mitigation as it pertains to vSphere. Please review KB52245: VMware Response to Speculative Execution security issues, CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 (aka Spectre and Meltdown) for a complete view on VMware’s response to these issues.

See VMware Security Advisory VMSA-2018-0004.3 for the VMware provided patches related to this KB.

Resolution

Patching the VMware vSphere hypervisor and updating the CPU Microcode (which the vSphere patches will do for the processors described in the below table will allow guest operating systems to use hardware support for branch target mitigation.

To enable hardware support for branch target mitigation in vSphere, apply these steps, in the order shown:

Note: Ensure vCenter Server is updated first, for more information, see the vMotion and EVC Information section.

Upgrade to one of the following versions of vCenter 5.5 – 6.5:

6.5 U1g: Release Notes.

6.0 U3e: Release Notes.

5.5 U3h: Release Notes.

Important: Please review the release notes for vCenter as there are new items listed in the ‘known issues’ section.

Apply both of the following ESXi patches. Note: these can both be applied at once so that only 1 reboot of the host is required:

ESXi 6.5: ESXi650-201803401-BG* and ESXi650-201803402-BG**

ESXi 6.0: ESXi600-201803401-BG* and ESXi600-201803402-BG**

ESXi 5.5: ESXi550-201803401-BG* and ESXi550-201803402-BG**

* These ESXi patches provide the framework to allow guest OSes to utilize the new speculative-execution control mechanisms. These patches do not contain microcode.

** These ESXi patches apply the microcode updates listed in the Table below. These patches do not contain the aforementioned framework.

Table 1. Lists the Intel and AMD processors for which microcode updates were included in ESXi patches ESXi650-201803402-BG, ESXi600-201803402-BG, and ESXi550-201803402-BG. Please contact your hardware vendor to determine if BIOS/firmware updates are recommended as there may be additional improvements included with those updates. Microcode updates are  necessary for ESXi to provide the new speculative-execution control mechanisms for guest VMs to mitigate CVE-2017-5715. VMware has included microcode updates in the aforementioned ESXi patches to simplify deployment processes and minimize downtime.

Table

Vendor

Code Name

FMS

Plt ID

MCU Rev

VMware VCG Name

Intel

Sandy Bridge DT

0x206a7

12

0x2d

Intel Xeon E3-1100 Series;

Intel Xeon E3-1200 Series;

Intel i7-2655-LE Series;

Intel i3-2100 Series

Intel

Sandy Bridge EP

0x206d7

6d

0x713

Intel Xeon E5-1400 Series;

Intel Xeon E5-1600 Series;

Intel Xeon E5-2400 Series;

Intel Xeon E5-2600 Series;

Intel Xeon E5-4600 Series;
Intel Pentium 1400 Series

Intel

Ivy Bridge DT

0x306a9

12

0x1f

Intel Xeon E3-1100-C-v2 Series;
Intel Xeon E3-1200-v2 Series;
Intel i3-3200 Series;

Intel i7-3500-LE/UE;
Intel i7-3600-QE;
Intel Pentium B925C

Intel

Ivy Bridge EP

0x306e4

ed

0x42c

Intel Xeon E5-4600-v2 Series;

Intel Xeon E5-2400-v2 Series;

Intel Xeon E5-2600-v2 Series;

Intel Xeon E5-1400-v2 Series;

Intel Xeon E5-2600-v2 Series

Intel

Ivy Bridge EX

0x306e7

ed

0x713

Intel Xeon E7-8800/4800/2800-v2 Series

Intel

Haswell DT

0x306c3

32

0x24

Intel Xeon E3-1200-v3 Series;
Intel i7-4700 EQ Series;
Intel i3-4300 Series;
Intel i5-4500-TE Series

Intel

Haswell EP

0x306f2

6f

0x3c

Intel Xeon E5-2400-v3 Series;

Intel Xeon E5-1400-v3 Series;

Intel Xeon E5-1600-v3 Series;

Intel Xeon E5-2600-v3 Series;

Intel Xeon E5-4600-v3 Series

Intel

Haswell EX

0x306f4

80

0x11

Intel Xeon E7-8800/4800-v3 Series

Intel

Broadwell H

0x40671

22

0x1d

Intel Xeon E3-1200-v4 Series;
Intel Core i7-5700EQ

Intel

Broadwell EP/EX

0x406f1

ef

0xb00002a

Intel Xeon E7-8800/4800-v4 Series;

Intel Xeon E5-4600-v4 Series;

Intel Xeon E5-2600-v4 Series;

Intel Xeon E5-1600-v4 Series

Intel

Broadwell DE

0x50662

10

0x15

Intel Xeon D-1500 Series

Intel

Broadwell DE

0x50663

10

0x7000012

Intel Xeon D-1500 Series

Intel

Broadwell DE

0x50664

10

0xf000011

Intel Xeon D-1500 Series

Intel

Broadwell NS

0x50665

10

0xe000009

Intel Xeon D-1500 Series

Intel

Skylake H/S

0x506e3

36

0xc2

Intel Xeon E3-1500-v5 Series;

Intel Xeon E3-1200-v5 Series

Intel

Skylake SP

0x50654

b7

0x2000043

Intel Xeon Platinum 8100 (Skylake-SP) Series;

Intel Xeon Gold 6100/5100, Silver 4100, Bronze 3100 (Skylake-SP) Series

Intel

Kaby Lake H/S/X

0x906e9

2a

0x84

Intel Xeon E3-1200-v6

AMD

Zen EPYC

0x800f12

n/a

0x8001227

AMD EPYC 7xx1 Series

To enable hardware support for branch target mitigation in Workstation/Fusion, the following steps should be followed:

Deploy one of the following versions of Workstation/Fusion:

Workstation 14.1.1

Workstation 12.5.9

Fusion 10.1.1

Fusion 8.5.10

Apply the Microcode/BIOS updates for CVE-2017-5715 from your platform vendor.

For each virtual machine, enable Hypervisor-Assisted Guest mitigation via the following steps:

Apply all security patches for your Guest OS which are available from the OS vendor.

Ensure that your VMs are using Virtual Hardware Version 9 or higher. Upgrading a virtual machine to the latest hardware version (multiple versions) (1010675) discusses Hardware Versions .

Virtual Hardware Version 9 is minimum requirement for Hypervisor-Assisted Guest Mitigation for branch target injection (CVE-2017-5715).

For best performance, Virtual Hardware Version 11 or higher is recommended. Virtual Hardware Version 11 enables PCID/INVPCID.  These features may reduce the performance impact of CVE-2017-5754 mitigations on CPUs that support those features. For the latest information on any VMware performance impact, see KB 52337

Power Off and then Power On the virtual machine (Restart is insufficient).

vMotion and EVC Information

An ESXi host that is running a patched vSphere hypervisor with updated microcode will see new CPU features that were not previously available.
These new features will be exposed to all Virtual Hardware Version 9+ VMs that are powered-on by that host. Because these virtual machines now see additional CPU features, vMotion to an ESXi host lacking the microcode or hypervisor patches applied will be prevented.
The vCenter patches enable vMotion compatibility to be retained within an EVC cluster.
In order to maintain this compatibility the new features are hidden from guests within the cluster until all hosts in the cluster are properly updated.  At that time, the cluster will automatically upgrade its capabilities to expose the new features. Unpatched ESXi hosts will no longer be admitted into the EVC cluster.

Confirmation of Correct Operation

To confirm a host has both VMware hypervisor and updated microcode, use the following steps:

Power on a Virtual Machine which is configured to use Virtual Hardware Version 9 or later.

Examine the vmware.log file for that VM and look for one of the following entries:

“Capability Found: cpuid.IBRS”

“Capability Found: cpuid.IBPB”

“Capabliity Found: cpuid.STIBP”

Any of the above log entires indicate that both the CPU microcode and hypervisor are properly updated.

To confirm end to end operation including guest OS enablement of hardware support for branch target mitigation, check with your OS vendor.

ESXi Microcode Update Information

For the known Spectre vulnerabilities, Intel and AMD have supplied CPU microcode updates for many affected processors to add the new speculative-execution control mechanism.

Most server vendors will soon be including these CPU microcode updates in their next BIOS/firmware update. It is strongly recommended that customers apply these BIOS/firmware updates for their servers.

The ESXi patches listed above will also automatically apply these critical CPU microcode updates if the server's BIOS/Firmware has not already applied them. The mechanism defined by AMD and Intel always ensures that the latest microcode update is active regardless of the order in which the BIOS and OS apply them. As a result, ESXi will never override a newer version of the microcode update provided by BIOS nor will the BIOS with an older version prevent ESXi from applying the newer version.

To confirm that the CPU has updated microcode for these features, power-on a VM on the host and then examine the vmware.log file.

An Intel CPU with updated microcode will have a non-zero value in host CPUID[7].EDX[26:27].
hostCPUID level 00000007, 0: 0x00000000 0xd39ffffb 0x00000008 0x0c000000
^ [4-9a-f]in nibble

An AMD CPU with updated its microcode will have a non-zero value in host CPUID[0x80000008].EBX[12].
hostCPUID level 80000008, 0: 0x00003030 0x00001007 0x0000603f 0x00000000
^ [13579bdf] in nibble

Changelog:

01/09/18: Initial publication
03/20/18: Updated KB with patch and procedure information in conjunction with VMSA-2018-0004.3.
04/09/19: Updated KB with information that the Hypervisor-Assisted Guest Mitigation process described in KB55111 is cumulative.

Related Information

适用于分支目标注入的管理程序辅助客户机缓解方法

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

Result 1 of 1

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Workstation Pro

VMware Workstation Player

VMware vSphere ESXi

VMware vCenter Server

VMware Fusion

Related Versions:

VMware Workstation Pro 14.x (for Linux)

VMware Workstation Player 14.x (Windows)

VMware Workstation Player 14.x (Linux)

VMware Workstation Player 14.x

VMware Workstation Player 12.x (Windows)

VMware Workstation Player 12.x (Linux)

VMware vSphere ESXi 6.5

VMware vSphere ESXi 6.0

VMware vSphere ESXi 5.5

VMware vSphere ESXi 5.1

VMware vCenter Server 6.5.x

VMware vCenter Server 6.0.x

VMware vCenter Server 5.5.x

VMware Fusion 8.x

view all

Take Our Survey

Support Assistant