Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

VMware Virtual Appliances and CVE-2017-5753, CVE-2017-5715 (Spectre), CVE-2017-5754 (Meltdown) (52264)

Last Updated: 11/8/2023Categories: SecurityTotal Views: 63866Language:
Chinese (Simplified)JapaneseEnglish

2 like this article

Subscribe to get an email
newsletter with new updates

2 people found this helpful Please provide article feedback:

Purpose

Update: The Operating System-Specific Mitigations described in KB55807 are cumulative and will also mitigate the issues described in this article.

The VMware Security Engineering, Communications, and Response group (vSECR) is investigating the impact these vulnerabilities may have on VMware virtual appliances.

CPU data cache timing can be abused by software to efficiently leak information out of mis-speculated CPU execution, leading to (at worst) arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts. Three variants have been recently discovered by Google Project Zero and other security researchers; these can affect many modern processors, including certain processors by Intel, AMD and ARM:

Variant 1: Bounds check bypass (CVE-2017-5753) also known as part of the Spectre Attacks.
Variant 2: Branch target injection (CVE-2017-5715) also known as part of the Spectre Attacks.
Variant 3: Rogue data cache load (CVE-2017-5754) also known as the Meltdown Attack.

Operating systems (OS), virtual machines, virtual appliances, hypervisors, server firmware, and CPU microcode must all be patched or upgraded for effective mitigation of these known variants.

This document will focus on Operating System-Specific Mitigations as they pertain to VMware Virtual Appliances.
Please review KB52245: VMware Response to Speculative Execution security issues, CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 (aka Spectre and Meltdown) for a holistic view on VMware’s response to these issues.

Resolution

Important:

This section will be updated with additional virtual appliances as investigations continue.

When Operating System-Specific Mitigations are made available for vCenter Server Appliance itself these will be in addition to the Hypervisor-Assisted Guest Mitigation which were added in the vCenter Sever versions described in VMSA-2018-0004.

Operating System-Specific Mitigations will include both Virtual Machine Hardware updates and guest OS fixes. Manually updating Virtual Machine Hardware in VMware Virtual Appliances is not supported.

Affected Virtual Appliances:

vSECR has evaluated the following appliances and determined that they may be affected by CVE-2017-5753, CVE-2017-5715, or CVE-2017-5754.

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories and click ‘subscribe to article’ on the right side of this page to be alerted when new information is added to this document. If a specific version number is not listed, then that entry refers to all supported versions of the appliance.

Mitigations and workarounds for the following affected virtual appliances are now documented in VMSA-2018-0007.

VMware vCloud Usage Meter

VMware Identity Manager

VMware vCenter Server 6.5

VMware vCenter Server 6.0

VMware vSphere Data Protection

VMware vSphere Integrated Containers

VMware vRealize Automation

Unaffected Virtual Appliances:

vSECR has completed evaluation of the following appliances and determined that under supported configurations they are not affected because there is no available path to execute arbitrary code without administrative privileges. This assumes that the underlying hypervisor(s) have been patched according to VMSA-2018-0002 to mitigate CVE-2017-5753, and CVE-2017-5715. If a specific version number is not listed, then the entry refers to all supported versions of the appliance.

VMware AppDefense Appliance

VMware Horizon DaaS Platform

VMware Horizon Mirage

VMware HCX

VMware Integrated OpenStack

VMware IoT Pulse

VMware Mirage

VMware NSX for vSphere

VMware NSX-T

VMware Skyline Appliance

VMware Unified Access Gateway

VMware vCenter Server 5.5

VMware vCloud Availability for vCloud Director

VMware vCloud Director Extender

VMware vRealize Business for Cloud

VMware vRealize Log Insight

VMware vRealize Network Insight

VMware vRealize Operations

VMware vRealize Orchestrator

VMware vSphere Replication

VMware Workbench

Note: Automated vulnerability scanners may report that these appliances are vulnerable to CVE-2017-5753, CVE-2017-5715, or CVE-2017-5754 even though the issue is not exploitable. These products will still be updating their respective kernels in scheduled maintenance releases as a precautionary measure.

Changelog:

01/18/18: Added VMware AppDefense, VMware vCloud Extender, VMware Horizon Mirage, VMware vRealize Business for Cloud, VMware Workbench, VMware HCX, VMware IoT Pulse, and VMware vSphere Data Protection. Updated VMware vRealize Automation with workaround.
01/22/18: Added VMware vCloud Usage Meter to list of affected products with workaround.
01/25/18: Added workaround for vRealize Automation 6.2.x.
02/08/18: Mitigation and workaround information has moved to VMSA-2018-0007 in conjunction with the release of vSphere Integrated Containers mitigations. Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.
04/09/19: Updated KB with information that the Operating System-Specific Mitigations described in KB55807 are cumulative and will also mitigate the issues described in this article

Related Information

VMware 虚拟设备和 CVE-2017-5753、CVE-2017-5715 (Spectre)、CVE-2017-5754
VMware 仮想アプライアンスと CVE-2017-5753、CVE-2017-5715 (Spectre)、CVE-2017-5754 (Meltdown)​

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Download and Install VMware Fusion (2014097)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Virtual Appliances

Related Versions:

Take Our Survey

Support Assistant