LT1F Vulnerability (L1TF) VMware

I would like to inform about important issue: Intel L1 Terminal Fault Vulnerabilities which high impact to vSphere Infrastructure. That issue had been announced at 00:00 AM today (10:00 AM PDT). This new class of vulnerabilities can occur on current and past Intel processors (from at least 2009 - 2018) when affected Intel microprocessors are speculating beyond an unpermitted data access. Reference: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html This new class of vulnerabilities can occur on current and past Intel processors (from at least 2009 - 2018) when affected Intel microprocessors are speculating beyond an unpermitted data access. By continuing the speculation in these cases, the affected Intel microprocessors expose a new side-channel for attack, allowing a malicious VM to infer data in the hypervisor and other VM's running on a core. The most severe of the three vulnerabilities (CVE-2018-3646: L1 Terminal Fault – VMM) impacts all hypervisors running on x86 Intel CPUs, including VMware vSphere, VMware Workstation and VMware Fusion. As a consequence, our services that use these products (including VMware Cloud on AWS and VMware Horizon Cloud), and our VMware Cloud Provider Program partner environments are impacted. As part of the August 14th disclosure by Intel, three vulnerabilities have been named: CVE-2018-3646 (L1 Terminal Fault - VMM) Mitigation of CVE-2018-3646 requires Hypervisor-Specific Mitigations for hosts running on Intel hardware. CVE-2018-3620 (L1 Terminal Fault - OS) Mitigation of CVE-2018-3620 requires Operating System-Specific Mitigations. CVE-2018-3615 (L1 Terminal Fault - SGX) CVE-2018-3615 does not affect VMware products and/or services. See KB54913 for more information.  The most severe of the three vulnerabilities (CVE-2018-3646: L1 Terminal Fault – VMM) impacts all hypervisors running on x86 Intel CPUs, including VMware vSphere, VMware Workstation and VMware Fusion. As a consequence, our services that use these products (including VMware Cloud on AWS and VMware Horizon Cloud), and our VMware Cloud Provider Program partner environments are impacted. Action Plan: CVE-2018-3646 (L1 Terminal Fault – VMM): This vulnerability impacts all hypervisors running on x86 Intel CPUs CVE-2018-3646 has two currently known attack vectors which will be referred to as "Sequential-Context" and "Concurrent-Context." Reference:           https://kb.vmware.com/s/article/55806 https://www.vmware.com/security/advisories/VMSA-2018-0020.html Patches for VMware Product Product Version Running On Severity Replace_with/Apply_Patch Mitigation/Workaround VC 6.7 Any Important 6.7.0d None VC 6.5 Any Important 6.5u2c None ESXi 6.7 Any Important ESXi670-201808401-BG* ESXi670-201808402-BG** ESXi670-201808403-BG* None ESXi 6.5 Any Important ESXi650-201808401-BG* None ESXi650-201808402-BG** ESXi650-201808403-BG* ESXi 6 Any Important ESXi600-201808401-BG* None ESXi600-201808402-BG** ESXi600-201808403-BG* ESXi 5.5 Any Important ESXi550-201808401-BG* None ESXi550-201808402-BG** ESXi550-201808403-BG* Notes: These patches only support to mitigated the Sequential-Context Attack Vector: a malicious VM can potentially infer recently accessed L1 data of a previous context (hypervisor thread or other VM thread) on either logical processor of a processor core. **These patches include microcode updates required for mitigation of the Sequential-context attack vector. This microcode may also be obtained from your hardware OEM in the form of a BIOS or firmware update. Concurrent-context attack vector: a malicious VM can potentially infer recently accessed L1 data of a concurrently executing context (hypervisor thread or other VM thread) on the other logical processor of the Hyper-Threading enabled processor core. Currently for mitigated this, please come to KB55806 https://kb.vmware.com/s/article/55806 Important note: Please try to apply in test environment before apply to production because when enable to solve this may be impacted to performance of system Reference: https://kb.vmware.com/s/article/55767 CVE-2018-3620 (L1 Terminal Fault - OS): Operating System-Specific Mitigations VMware has investigated the impact CVE-2018-3620 may have on virtual appliances. Details on this investigation including a list of unaffected virtual appliances can be found in KB55807. Products that ship as an installable windows or linux binary are not directly affected, but patches may be required from the respective operating system vendor that these products are installed on. VMware recommends contacting your 3rd party operating system vendor to determine appropriate actions for mitigation of CVE-2018-3620. This issue may be applicable to customer-controlled environments running in a VMware SaaS offering, review KB55808 via Latest imported feed items on VMware Blogs https://ift.tt/2L71Nic If New feed item from https://blogs.vmware.com/feed, then send me an email at kr