This post is also available in: Italian

Reading Time: 3 minutes

VMware has released (on Feb, 15th) a new vCSA version: vCenter Server 6.5 U1f, with build number 7801515.

This release patches the vCSA operating system (Photon OS) mainly against two vulnerabilities: bounds-check bypass (Spectre-1, CVE-2017-5753) and rogue data cache load issues (Meltdown, CVE-2017-5754). As of now, there is still no patch for branch target injection vulnerability (Spectre-2, CVE-2017-5715).

VMware has also updated the security advisory dealing with all of its virtual appliances updates for Spectre and Meltdown vulnerabilities, VMSA-2018-0007. But note that VMSA-2018-0004.2 has not been updated yet, and it still report that the suggested version for vCenter 6.5 is still 6.5U1e!

It’s funny that the Linux kernel has already been patches (for most of the issues) several weeks ago, in this case having a customized Linux version and using a virtual applicance could be a cons (but this is a most general discussion about pro and cons of VA).

At thist point the patch is still available only on the patch repository and not on the official download page of vSphere 6.5 where the lastest version remain 6.5U1e. For the same reason the release notes are still missing.

For how install this patch, you can follow this good post, but the beauty of the vCSA is that you can manage the entire update process using the VAMI interface.

But note that after the update, you have to follow also the KB 52312: vCenter Server Appliance (and PSC) 6.5 / 6.0 Workaround for CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 (aka Spectre and Meltdown).

The vCenter Server Appliance team has investigated CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754 and determined that the known attack vectors for this vulnerability can be removed by performing the steps detailed in either workaround in this article. This workaround is meant to be a temporary solution only and permanent fixes will be released as soon as they are available.

All users with roles of “Operator” may not be able to perform actions that were previously possible while the workaround is in place. This is the only functionality impact known at the time of publishing this article.

One possible workaround is to remove the access to the appliance shell for non-root users:

  1. Login to the vCenter Server Appliance with an SSH session and the root user.
  2. Backup the /etc/passwd file by with this command:
cp /etc/passwd /etc/passwd.bkup
  1. To list all users, run this command in the appliance shell and take note of the users listed:
user.list
  1. Open the /etc/passwd file with a plain text editor using this command:
vi /etc/passwd
  1. Search for all non-root users who have operator access.
For example the user test has access to appliancesh.
test:x:1020:100:test:/home/test:/bin/appliancesh
  1. Change the default shell access from /bin/appliancesh to /sbin/nologin.
For example:
test:x:1020:100:test:/home/test:/sbin/nologin
  1. Save and exit the file

To confirm that the workaround run these steps:

  1. Attempt to log into vCenter Server Appliance using SSH and user with the Operator role.
  2. Operator users should no longer be able to log in.
Share

Related Posts

  • VMware vCenter 6.5U1f per Meltdown e Spectre

    VMware la rilasciato (ancora il 15 febbraio) una nuova versione della vCSA version: vCenter Server 6.5 U1f, che porta il build number a 7801515. In questa nuova versione della vCSA viene aggiornato il Photon contro due delle vulnerabilità relative alle problematiche Meltdown e Spectre. La nuova patch vCenter…

  • VMware vCenter Virtual Appliance issues

    Starting from vSphere 5.0, the vCenter Server Virtual Appliance (vCSA) is a new deployment options with some pros and cons. Some of the cons may limit it in the large environments, but starting with the version 5.5 the embedded database has more interesting limits to…

  • VMware vCenter and PSC topologies

    This is an article realized for StarWind blog and focused on the design and architecture of VMware vCenter and PSC topologies. See the original post. You can “federate” multiple vCenter Server systems using vCenter Linked Mode (introduced in vSphere 4.0) to build a single pane of glass and share…

Virtualization, Cloud and Storage Architect. Tech Field delegate. VMUG IT Co-Founder and board member. VMware VMTN Moderator and vExpert 2010-24. Dell TechCenter Rockstar 2014-15. Microsoft MVP 2014-16. Veeam Vanguard 2015-23. Nutanix NTC 2014-20. Several certifications including: VCDX-DCV, VCP-DCV/DT/Cloud, VCAP-DCA/DCD/CIA/CID/DTA/DTD, MCSA, MCSE, MCITP, CCA, NPP.