Spectre- und Meltdown-Schwachstellen in VMware-Umgebungen

Since these vulnerabilities were publicly disclosed, there have been several articles (Security Advisories and KBs) and recommendations on how to patch VMware environments. Some of the updates are overriding the initial ones and some are adding more details. Naturally, with so much information flying around and the pressure to mitigate these critical vulnerabilities as soon as possible, there is some level of confusion to what needs to be done. 

The status, as of the time of this article (January 16th 2018 11:00 UTC) is as follows:

Spectre

There are two VMware Security Advisory documents for the Spectre vulnerability

* The situation with the microcode patches is quite complicated, especially if you reacted fast. The initial response of VMware for this issue was to aid customers in patching microcode by releasing ESXi patch (see KB 52085) , but a few days after, Intel notified VMware that some CPU families using this microcode are affected by Intel Sightings (a CPU related bug): KB 52345 , so these patches have been pulled back by VMware and a workaround was announced for the customers who have already installed the patches. 

The diagram below summarizes the current situation for these two advisories:

Meltdown

The ESXi hypervisor is not affected by this vulnerability, but some other VMware products deployed as virtual appliance might be affected, so make sure to check which appliances are affected in KB 52264.

At Runecast, we are continuously monitoring the trusted sources of information and we keep our issues definition database up to date so you can have the peace of mind that your VMware infrastructure is rock solid. As you've seen in the previous blog post we respond very fast and we have included all the needed automatic checks in the latest update, so you can easily find the affected components.

Additional details regarding these vulnerabilities: VMware Response to Speculative Execution security issues, CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 (aka Spectre and Meltdown) (52245)