---
title: "VMware response on recent Security issues - Specter & Meltdown (Update 2)"
canonical: "https://www.virtcloudrocks.com/space/vblog01/blog/720996/VMware%20response%20on%20recent%20Security%20issues%20-%20Specter%20%26%20Meltdown%20(Update%202)"
format: markdown
---
Below the latest update received from VMware Security Advisory, regarding recent security issues on INTEL CPUs, SPECTRE and MELTDOWN

  


There are 2 KBs to follow and I would recommend you subscribe for any updates:

[https://kb.vmware.com/s/article/52085](https://kb.vmware.com/s/article/52085)

[https://kb.vmware.com/s/article/52264](https://kb.vmware.com/s/article/52264) 

## **What levels of mitigation are required?**

There are three level of mitigation required.

- Hypervisor-Specific Mitigation - takes care of VMKernel, Hardware version of VM’s and any VM management risks
- Hypervisor-Assisted Guest Mitigation - enabled guest OS patches to be effective,
- Operating System-Specific Mitigations- GOS vendors. Firmware/BIOS upgrade is required for GOS patches to be effective. that can be done in two ways.
  - CPU microcode from platform vendor.
  - ESXi microcode patch.. recommended is first, for the time being second option can help the GOS patches to be effective

 

## **What do I need to patch in order to mitigate the vulnerability?**

To completely remediate VM workloads from Meltdown, we need patches from

- GuestOS,
- Hypervisor(ESXi) and
- System ROM/BIOS.
- Also vCenter to mitigate vMotion security issue
- VM hardware version in minimum 9

** **

## **Let's say a customer had patches at all levels, guest, hypervisor and BIOS but the VM is on a lower HW version is it still vulnerable?**

As stated in VMSA 2018-0004, HW upgrade is a requirement.  
The virtual hardware will expose some features provided by the updated microcode. If you don't update the hardware version to 9+ your GuestOS will not see those feature. Guest OS patches rely on these new features.

 

## **What order should I patch?**

Order is outlined in KB: 52085.

[https://kb.vmware.com/s/article/52085](https://kb.vmware.com/s/article/52085)

If customer is applying patches outlined in VMSA-2018-0004, they are covered for both.

 

## **Appliance patches are listed under**

[kb.vmware.com/s/article/52264](https://kb.vmware.com/s/article/52264) 

 

## **Is there any performance impact by the patching?**

No performance impact should incur from VMware patches, however the GuestOS mitigation will likely impact performance. Customer should check benchmarks from Guest OS vendor if available (Redhat published a benchmark depending on different workloads)

 

## **I heard a statement that ESXi is not affected, is that true?**

An unpatched ESXi will allow host to guest, and guest to guest exploits. Therefore from a VMware point of view its affected as users running VMs will be affected.

ESXi is not affected by Meltdown, it is affected by Spectre Variant 1+2 (now patched)

 

## **Any further planned patches?**

No more planned ESXi patches. Intel may supply us with additional microcode to add to ESXi but from an exploit point of view we have fixed known issues.

We are still waiting for Appliance level patches and possibly any future enablement that might be required to facilitate other fixes coming from ECO systems (Hardware/OS vendors). No definitive number or timelines at this point of time

 

> ℹ️ **Customers have to update to minimum ESXi 5.5 no fixes for previous versions.**
> ℹ️ 
> ℹ️   
> ℹ️ 
> ℹ️ 
> ℹ️ **For a customer who is still running legacy OS (win2003 and WinXP SP3) is there a way to protect his VM via CPU Mask ?**
> ℹ️ 
> ℹ️ No. There is not hypervisor level protection for the in guest attack vector for any of those OSs.