KB Link
Purpose
Resolution
Document Id
52345
Purpose
Although VMware strongly recommends that customers obtain microcode patches through their hardware vendor, as an aid to customers, VMware also included the initial microcode patches in ESXi650-201801402-BG, ESXi600-201801402-BG, and ESXi550-201801401-BG. Intel has notified VMware of recent sightings that may affect some of the initial microcode patches that provide the speculative execution control mechanism for a number of Intel Haswell and Broadwell processors. The issue can occur when the speculative execution control is actually used within a virtual machine by a patched OS. At this point, it has been recommended that VMware remove exposure of the speculative-execution mechanism to virtual machines on ESXi hosts using the affected Intel processors until Intel provides new microcode at a later date.
Resolution
Note: All the patches associated with VMSA-2018-0004 have been pulled back from the online and offline portal.
For servers using the Intel Haswell and Broadwell processors (see Table 1 for the specific list of affected VMware vSphere supported Intel Haswell and Broadwell processors) that have applied ESXi650-201801402-BG, ESXi600-201801402-BG, or ESXi550-201801401-BG VMware recommends the following:
The effect of these recommendations for an affected ESXi host is that the speculative execution control mechanism is no longer available to virtual machines even if the server firmware provides the same microcode independently. (For customers who have applied the same microcode updates from their server vendor’s Firmware/BIOS, this recommendation may remove the need to downgrade the firmware. Consult your server vendor directly for guidance.)
VMware is working closely with Intel and the industry to come to a quick resolution of this Intel microcode issue and provide an update to our customers as soon as possible.
Table 1:
Note: Processors impacted by Intel Microcode sightings are highlighted in yellow.
- VUM Customer who has already downloaded the patches associated with VMSA-2018-0004 would continue to persist in the VUM depot even after the EP is rolled-back. But, if customer tries to remediate the corresponding patch baseline created against the bulletins of these patches, following error would be encountered - "Cannot download software packages from patch source".
- For Customers who have configured UMDS for offline patching, the patches associated with VMSA-2018-0004 continue to persist in the UMDS depot directory even after roll-back and can be patched successfully from the same. It is recommended that such customers manually remove the binaries/VIBs from the UMDS directory or direct the downloads to the new UMDS directory location to be in-sync with VMware’s online depot. For more information see How to configure the UMDs download location.
- Customers who use Stateless boot through Autodeploy will have to update the existing rule to point to the image profile associated with VMSA-2018-0002 instead. If you continue without updating rule, the Autodeploy would stateless boot into the image associated with VMSA-2018-0004 which is not intended.
For servers using the Intel Haswell and Broadwell processors (see Table 1 for the specific list of affected VMware vSphere supported Intel Haswell and Broadwell processors) that have applied ESXi650-201801402-BG, ESXi600-201801402-BG, or ESXi550-201801401-BG VMware recommends the following:
- On each affected ESXi host, add the following line in the /etc/vmware/config file:
cpuid.7.edx = "----:00--:----:----:----:----:----:----"
- This will hide the speculative-execution control mechanism for virtual machines which are power-cycled afterwards on the ESXi host.
- This line will need to be removed after applying a future fixed microcode from Intel in order to enable the full guest OS mitigations for CVE-2017-5715.
- When convenient, power-cycle virtual machines on the affected ESXi hosts; rebooting of the ESXi host is not required.
- Stateless vSphere ESXi Hosts using ESXi 5.5 or 6.0, this line must be re-applied every time the ESXi host reboots. VMware is investigating other options at this time.
The effect of these recommendations for an affected ESXi host is that the speculative execution control mechanism is no longer available to virtual machines even if the server firmware provides the same microcode independently. (For customers who have applied the same microcode updates from their server vendor’s Firmware/BIOS, this recommendation may remove the need to downgrade the firmware. Consult your server vendor directly for guidance.)
VMware is working closely with Intel and the industry to come to a quick resolution of this Intel microcode issue and provide an update to our customers as soon as possible.
Table 1:
Note: Processors impacted by Intel Microcode sightings are highlighted in yellow.
| VCG Processor Series/Family | Encoded CPUID Family. Model. Stepping | Processor SKU Stepping | Microcode Revision | ||
| Intel Xeon E3-1200-v3 Intel i3-4300 Intel i5-4500-TE Intel i7-4700-EQ | 0x000306C3 | C0 | 0x00000023 | ||
| Intel Xeon E5-1600-v2 Intel Xeon E5-2400-v2 Intel Xeon E5-2600-v2; Intel Xeon E5-4600-v2 | 0x000306E4 | C1/M1/S1 | 0x0000042A | ||
| Intel Xeon E5-1600-v3 Intel Xeon E5-2400-v3 Intel Xeon E5-2600-v3; Intel Xeon E5-4600-v3 | 0x000306F2 | C0/C1, M0/M1, R1/R2 | 0x0000003B | ||
| Intel Xeon E7-8800/4800-v3 | 0x000306F4 | E0 | 0x00000010 | ||
| Intel Xeon E3-1200-v4 | 0x00040671 | G0 | 0x0000001B | ||
| Intel Xeon E5-1600-v4 Intel Xeon E5-2600-v4; Intel Xeon E5-4600-v4 | 0x000406F1 | B0/M0/R0 | 0x0B000025 | ||
| Intel Xeon E7-8800/4800-v4 | 0x000406F1 | B0/M0/R0 | 0x0B000025 | ||
| Intel Xeon Gold 61/00/5100, Silver 4100, Bronze 3100 (Skylake-SP) Series | 0x00050654 | H0 | 0x0200003A | ||
| Intel Xeon Platinum 8100 (Skylake-SP) Series | 0x00050654 | H0 | 0x0200003A | ||
| Intel Xeon D-1500 | 0x00050663 | V2 | 0x07000011 | ||
| Intel Xeon E3-1200-v5 | 0x000506E3 | R0/S0 | 0x000000C2 | ||
| Intel Xeon E3-1200-v6 | 0x000906E9 | B0 | 0x0000007C |
No comments:
Post a Comment