Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

VMware Response to Speculative Execution security issues, CVE-2017-5753, CVE-2017-5715, CVE-2017-5754, and CVE-2018-3693 (aka Spectre and Meltdown) (52245)

Last Updated: 11/8/2023Categories: SecurityTotal Views: 236064Language:
Chinese (Simplified)JapaneseEnglish

6 like this article

Subscribe to get an email
newsletter with new updates

6 people found this helpful Please provide article feedback:

Purpose

Update: The Sequential-context attack vector Hypervisor-Specific Mitigations described in VMSA-2018-0020, are cumulative and will also mitigate the issues described in VMSA-2018-0002.

The purpose of this article is to describe the security issues related to speculative execution in modern-day processors as they apply
to VMware and then highlight VMware’s response.

For VMware, the mitigations fall into 3 different categories:

Hypervisor-Specific Mitigation

Hypervisor-Assisted Guest Mitigation

Operating System-Specific Mitigations

Additionally, VMware is mitigating these issues in its services.

This Knowledge Base article will be updated as new information becomes available.

Introduction

On January 3, 2018, it became public that CPU data cache timing can be abused by software to efficiently leak information out of mis-speculated CPU execution, leading to (at worst) arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts. Three variants have been recently discovered by Google Project Zero and other security researchers; these can affect many modern processors, including certain processors by Intel, AMD and ARM:

Variant 1: bounds check bypass (CVE-2017-5753 and CVE-2018-3693) – a.k.a. Spectre

Variant 2: branch target injection (CVE-2017-5715) – a.k.a. Spectre

Variant 3: rogue data cache load (CVE-2017-5754) – a.k.a. Meltdown

Operating systems (OS), virtual machines, virtual appliances, hypervisors, server firmware, and CPU microcode must all be patched or upgraded for effective mitigation of these known variants. General purpose operating systems are adding several mitigations for them. Most operating system mitigations can be applied to unpatched CPUs (and hypervisors) and will significantly reduce the attack surface. However, some operating system mitigations will be more effective when a new speculative-execution control mechanism is provided by updated CPU microcode (and virtualized to VMs by hypervisors). There can be a performance impact when an operating system applies the above mitigations; consult the specific OS vendor for more details.

Hypervisor-Specific Mitigation

Mitigates leakage from the hypervisor or guest VMs into a malicious guest VM. VMware’s hypervisor products are affected by the known examples of variant 1 and variant 2 vulnerabilities and do require the associated mitigations. Known examples of variant 3 do not affect VMware hypervisor products.

Update: On July 10th, 2018 Intel updated security advisory INTEL-OSS-10002 with CVE-2018-3693 a.k.a. Bounds Check Bypass Store. This issue is similar to Spectre variant 1 previously mentioned. At the time of this publication VMware has not found any exploitable instances of this vulnerability in our hypervisors. VMware will remain vigilant in updating our mitigations as new speculative-execution vulnerabilities are uncovered.

VMware hypervisors do not require the new speculative-execution control mechanism to achieve this class of mitigation and therefore these types of updates can be installed on any currently supported processor. For the latest information on any VMware performance impact, see KB 52337.

Hypervisor-Assisted Guest Mitigation

It virtualizes the new speculative-execution control mechanism for guest VMs so that a Guest OS can mitigate leakage between processes within the VM. This mitigation requires that specific microcode updates that provide the mechanism are already applied to a system’s processor(s) either by ESXi or by a firmware/BIOS update from the system vendor. The ESXi patches for this mitigation will include all available microcode updates at the time of release and the appropriate one will be applied automatically if the system firmware has not already done so.
No significant additional overhead is expected by virtualizing the speculative-execution control mechanism in the hypervisor. There can be a performance impact when an operating system applies this mitigation; consult the specific OS vendor for more details.

Operating System-Specific Mitigations

Mitigations for Operating Systems(OSes) are provided by your OS Vendors. In the case of virtual appliances, your virtual appliance vendor will need to integrate these into their appliances and provide an updated appliance.

VMware Software-as-a-Service (SaaS) Status Updates

VMware is in the process of investigating and patching its services. The current status is found in the Resolution section.

Performance impact considerations

For the latest information on how mitigations for the aforementioned issues may affect performance, see KB 52337.

Resolution

Documentation Timeline

01/03/18: VMware Security Advisory Published - VMSA-2018-0002

01/05/18: KB52264 Published - VMware Virtual Appliances and CVE-2017-5753, CVE-2017-5715 (Spectre), CVE-2017-5754 (Meltdown)

01/08/18: KB52245 Published - VMware Response to Speculative Execution security issues, CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 (aka Spectre and Meltdown)

01/09/18: VMware Security Advisory Major Update - VMSA-2018-0002.1

01/09/18: VMware Security Advisory Published - VMSA-2018-0004

01/09/18: KB52085 Published - Hypervisor-Assisted Guest Mitigation for branch target injection

01/10/18: VMware Security Advisory Major Update - VMSA-2018-0004.1

01/12/18: KB52337 Published - VMware Performance Impact for CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 (aka Spectre and Meltdown)

01/12/18: VMware Security Major Update - VMSA-2018-0004.2

01/12/18: KB52345 Published - Intel Sightings in ESXi Bundled Microcode Patches for VMSA-2018-0004

01/13/18: VMware Security Advisory Major Update - VMSA-2018-0002.2

01/22/18: VMware Security Advisory Major Update - VMSA-2018-0002.3

02/08/18: VMware Security Advisory Published - VMSA-2018-0007

02/15/18: VMware Security Advisory Major Update - VMSA-2018-0007.1

03/15/18: VMware Security Advisory Major Update - VMSA-2018-0007.2

05/03/18: VMware Security Advisory Major Update - VMSA-2018-0007.3

05/31/18: VMware Security Advisory Major Update - VMSA-2018-0007.4

07/09/18: Added Information on CVE-2018-3693.

Hypervisor-Specific Mitigation

Specific versions of VMware vSphere ESXi (5.5, 6.0, 6.5, VMC), VMware Workstation (12.x, 14.x), and VMware Fusion (8.x, 10.x) have already been updated with hypervisor-specific mitigations as indicated in further detail by VMSA-2018-0002.

Please note that all provided VMware hypervisor-specific mitigations mentioned in this Knowledge Base article can only address known examples of the variant 1 and variant 2 vulnerabilities; known variant 3 examples do not affect VMware hypervisors. VMware will remain vigilant in updating our mitigations as new speculative-execution vulnerabilities are uncovered and as new CPU vendor microcode becomes available.

Hypervisor-Assisted Guest Mitigation

Hypervisor-Assisted Guest Mitigation patches are now available. Mitigation requirements including patches have been announced in VMSA-2018-0004.3. Detailed instructions on enabling Hypervisor-Assisted Guest Mitigation can be found in Hypervisor-Assisted Guest Mitigation for branch target injection (52085).

On 01/12/18 VMware removed ESXi patches which were originally released on 01/09/18 with VMSA-2018-0004. For historical information on this event, please see KB52345.

Operating System-Specific Mitigations

VMware Virtual Appliances

General information on VMware virtual appliances including a list of affected and unaffected appliances can be found here: https://kb.vmware.com/s/article/52264.

Mitigations and workarounds for affected virtual appliances are now documented in VMSA-2018-0007.

Photon OS
Photon OS has begun releasing fixes which are documented in Photon OS Security Advisories.
PHSA-2018-1.0-0097
PHSA-2018-2.0-0010
PHSA-2018-1.0-0098
PHSA-2018-2.0-0011

VMware products that are installed and run on Windows
VMware products that run on Windows might be affected if Windows has not been patched with appropriate updates. VMware recommends that customers contact Microsoft for resolution.

VMware products that are installed and run on Linux (excluding virtual appliances), Mac OS, iOS or Android
VMware products that run on Linux (excluding virtual appliances), Mac OS, iOS, or Android might be affected if the operating system has not been patched with appropriate updates. VMware recommends that customers contact their operating system vendor for resolution.

VMware Software-as-a-Service (SaaS) Status Updates

Air-Watch
https://support.air-watch.com/articles/115015960907
https://support.air-watch.com/articles/115015960887

VMware Horizon Cloud
http://status.horizon.vmware.com/incidents/nd1ry9frbkvq

VMware Cloud on AWS
https://docs.vmware.com/en/VMware-Cloud-on-AWS/0/rn/vmc-on-aws-relnotes.html

VMware Identity Manager SaaS
http://status.vmwareidentity.com

Related Information

投機的実行に伴うセキュリティの問題 CVE-2017-5753、CVE-2017-5715、CVE-2017-5754（Spectre および Meltdown）に対する VMware の対応 (52954)
中文简体：VMware 对预测执行安全问题 CVE-2017-5753、CVE-2017-5715、CVE-2017-5754（亦称 幽灵 (Spectre) 和 熔断 (Meltdown)）的响应

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

No results for undefined

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

Datacenter

Related Versions:

Take Our Survey

Support Assistant