Browsing Posts in vSecurity

Reading Time: 4 minutes This year has started with the revelation of the Meltdown and Spectre vulnerabilities afftecting most of the (old and new) processors including Intel, AMD and ARM… but also others. In little less than one year we are still far from the solution because there are some patches, but those patches have serious performance impacts and sometimes are those patches require more and more time to become effective (instead of causing new issues).

Reading Time: 4 minutes VMware NSX-T Data Center is the next generation product that provides a scalable network virtualization and micro-segmentation platform for multi-hypervisor environments, container deployments, and native workloads. It has not yet become features parity with NSX-v, but the gap is closing faster and there are also several new features and capabilities available ONLY on NSX-T. And the product is growing faster: on June was release the NSX-T Data Center 2.2.0 and now there is the new NSX-T Data Center 2.3.0 release (see the release notes).

Reading Time: 9 minutes With all those Meltdown, Spectre, Foreshadow, … bugs that affect several CPU, you may be interested in what can be the overall performance impact for all the related patches. There isn’t a simple answer, because it really varies by the processor vendor (Intel CPUs are more affected than AMD CPUs), probably also by CPU the family, for sure by the type of workloads (CPU bound workloads will be more affected, but it depends also on which instructions are used), … but also the type of environment.

Reading Time: 7 minutes The L1 Terminal Fault (aka Foreshadow) bug is another speculative execution side channel attack that affects Intel Core processors and Intel Xeon processors only. For VMware vSphere, there are some patches available as described in this document: VMSA-2018-0020. All patches have been released on August, 14th 2018.

Reading Time: 1 minute This is an article realized for StarWind blog and focused on the possible security threats in a virtual environment. See also the original post. Security is typically a hot-topic due also to several regulations and compliant rules and laws. But more important, a security breach can have huge collateral effects, also if no data has been stoled, or compromised. But, for example, a “simple” DoS attack that makes a service not available can have a bad effect on the reputation of a B2C company. This post will try to give an idea of some possible security threads in a […]

Reading Time: 2 minutes Now that Meltdown and Spectre vulnerabilities are almost fixed, there is a new critical vulnerability for several Intel CPU called BranchScope, discovered by some researchers from four universities. It’s again a speculative execution issue, in the method a processor uses to predict where its current computational task. By exploiting this flaw, attackers with local access could pull data stored from memory that’s otherwise inaccessible to all applications and users.

Reading Time: 3 minutes VMware has released (on Feb, 15th) a new vCSA version: vCenter Server 6.5 U1f, with build number 7801515. This release patches the vCSA operating system (Photon OS) mainly against two vulnerabilities: bounds-check bypass (Spectre-1, CVE-2017-5753) and rogue data cache load issues (Meltdown, CVE-2017-5754). As of now, there is still no patch for branch target injection vulnerability (Spectre-2, CVE-2017-5715). VMware has also updated the security advisory dealing with all of its virtual appliances updates for Spectre and Meltdown vulnerabilities, VMSA-2018-0007. But note that VMSA-2018-0004.2 has not been updated yet, and it still report that the suggested version for […]

Reading Time: 2 minutes We are still far from a solution for the Meltdown and Spectre, considering the delay of the microcode releases and the complexity of the possible Spectre fixes… And now, some security researchers from NVIDIA and Princeton have discovered new variants of the Meltdown and Spectre flaws that may be more difficult to be fixed (but also to be exploited) than the originals.

Reading Time: 6 minutes The mitigations for Meltdown and Spectre issues have involved a combination of different type of fixes: some software based, such as Microsoft and Linux versions of the “kernel page table isolation” protection, but also fome hardware based, like the Intel’s microcode updates (part that is still missing in most cases). Both type of patches can cause performance overheads and have some kind of impact on your environment. But how can you estimate it (before apply the patches) and how can you measure it (when the patches have been applied)?

Reading Time: 8 minutes In June 2017, a team constituted of independent researchers, university research labs, and some of Google’s Project Zero members and cyberus technology discovered two security vulnerabilities enabled by the widespread use of speculative execution in most of the CPU. The problem was also independently discovered by other researchers, at about the same time. These vulnerabilities, called Meltdown and Spectre, were made public in January 2018. Meltdown and Spectre are critical vulnerabilities existing in several modern CPU: these hardware bugs allow programs to steal data which is currently processed on the computer. Meltdown and Spectre can affect personal […]

Reading Time: 5 minutes Linux Kernel 4.15 has been released on 28 Jan 2018 and, thanks to the entire Linux Kernel development team, this release contains the latest code to deal with Meltdown and Spectre issues and minize the related risks. The Kernel is the core code in the operating system managing low level tasks. In the update both vulnerabilities are explicitly addressed.And the interesting aspect is that the performance are not so bad! There are infact three instinct vulnerabilities identified, one Meltdown and two variations of Spectre (known as v1 and v2). Kernel 4.15 actually address only Meltdown and […]

Reading Time: 5 minutes Meltdown and Spectre are critical vulnerabilities existing in several modern CPU: these hardware bugs allow programs to steal data which is currently processed on the computer. Meltdown and Spectre can affect personal computers, mobile devices, server and several cloud services. There isn’t a single simple way to minimize those security risks, because you need to patch different levels of your stack. For a VMware environment, there are some tools to check your status (and also to help you to apply the right patches).

© 2018-2011 vInfrastructure Blog | Disclaimer & Copyright