LT1F Vulnerability (L1TF) VMware





I would like to inform about important issue: Intel L1 Terminal Fault Vulnerabilities which high impact to vSphere Infrastructure. That issue had been announced at 00:00 AM today (10:00 AM PDT). This new class of vulnerabilities can occur on current and past Intel processors (from at least 2009 - 2018) when affected Intel microprocessors are speculating beyond an unpermitted data access.


This new class of vulnerabilities can occur on current and past Intel processors (from at least 2009 - 2018) when affected Intel microprocessors are speculating beyond an unpermitted data access.
By continuing the speculation in these cases, the affected Intel microprocessors expose a new side-channel for attack, allowing a malicious VM to infer data in the hypervisor and other VM’s running on a core.
The most severe of the three vulnerabilities (CVE-2018-3646: L1 Terminal Fault – VMM) impacts all hypervisors running on x86 Intel CPUs, including VMware vSphere, VMware Workstation and VMware Fusion. As a consequence, our services that use these products (including VMware Cloud on AWS and VMware Horizon Cloud), and our VMware Cloud Provider Program partner environments are impacted.


As part of the August 14th disclosure by Intel, three vulnerabilities have been named:

  1. CVE-2018-3646 (L1 Terminal Fault - VMM)
Mitigation of CVE-2018-3646 requires Hypervisor-Specific Mitigations for hosts running on Intel hardware.

  1. CVE-2018-3620 (L1 Terminal Fault - OS)
Mitigation of CVE-2018-3620 requires Operating System-Specific Mitigations.

  1. CVE-2018-3615 (L1 Terminal Fault - SGX)
CVE-2018-3615 does not affect VMware products and/or services. See KB54913 for more information.

 The most severe of the three vulnerabilities (CVE-2018-3646: L1 Terminal Fault – VMM) impacts all hypervisors running on x86 Intel CPUs, including VMware vSphere, VMware Workstation and VMware Fusion. As a consequence, our services that use these products (including VMware Cloud on AWS and VMware Horizon Cloud), and our VMware Cloud Provider Program partner environments are impacted.


Action Plan:

CVE-2018-3646 (L1 Terminal Fault – VMM): This vulnerability impacts all hypervisors running on x86 Intel CPUs

CVE-2018-3646 has two currently known attack vectors which will be referred to as "Sequential-Context" and "Concurrent-Context."





Reference:           https://kb.vmware.com/s/article/55806

Patches for <customer>

VMware Product
Product Version
Running On
Severity
Replace_with/Apply_Patch
Mitigation/Workaround
VC
6.7
Any
Important
6.7.0d
None
VC
6.5
Any
Important
6.5u2c
None
ESXi
6.7
Any
Important
ESXi670-201808401-BG*
ESXi670-201808402-BG**
ESXi670-201808403-BG*
None
ESXi
6.5
Any
Important
ESXi650-201808401-BG*
None
ESXi650-201808402-BG**
ESXi650-201808403-BG*
ESXi
6
Any
Important
ESXi600-201808401-BG*
None
ESXi600-201808402-BG**
ESXi600-201808403-BG*
ESXi
5.5
Any
Important
ESXi550-201808401-BG*
None
ESXi550-201808402-BG**
ESXi550-201808403-BG*

Notes: These patches only support to mitigated the Sequential-Context Attack Vector: a malicious VM can potentially infer recently accessed L1 data of a previous context (hypervisor thread or other VM thread) on either logical processor of a processor core.

**These patches include microcode updates required for mitigation of the Sequential-context attack vector. This microcode may also be obtained from your hardware OEM in the form of a BIOS or firmware update.

Concurrent-context attack vector: a malicious VM can potentially infer recently accessed L1 data of a concurrently executing context (hypervisor thread or other VM thread) on the other logical processor of the Hyper-Threading enabled processor core. Currently for mitigated this, please come to KB55806 https://kb.vmware.com/s/article/55806

Important note: Please try to apply in test environment before apply to production because when enable to solve this may be impacted to performance of system

CVE-2018-3620 (L1 Terminal Fault - OS): Operating System-Specific Mitigations

VMware has investigated the impact CVE-2018-3620 may have on virtual appliances. Details on this investigation including a list of unaffected virtual appliances can be found in KB55807.

Products that ship as an installable windows or linux binary are not directly affected, but patches may be required from the respective operating system vendor that these products are installed on. VMware recommends contacting your 3rd party operating system vendor to determine appropriate actions for mitigation of CVE-2018-3620. This issue may be applicable to customer-controlled environments running in a VMware SaaS offering, review KB55808



Comments

Popular posts from this blog

VM Creation Date & Time from Powercli

Changing the FQDN of the vCenter appliance (VCSA)

Could not connect to one or more vCenter Server systems: https://FQDN:443/sdk