vCloud Director and ESXi patches for Spectre and Meltdown vulnerabilities (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754)

Products

• VMware Cloud Director

Issue/Introduction

This article provides information about:

• The impact of Meltdown and Spectre vulnerabilities on vCloud Director for Service Providers.
• vCloud Director compatibility with the VMware ESXi patches recently released to mitigate the vulnerabilities.

Environment

VMware Cloud Director for Service Provider 9.0.x
VMware Cloud Director for Service Provider 8.10.x
VMware Cloud Director for Service Provider 8.x

Resolution

The article VMware Response to Speculative Execution security issues, CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 (aka Spectre and Meltdown) describes the effect of Spectre and Meltdown and types of mitigation available for ESXi.  To the extent that Cloud Provider’s ESXi hosts are used to run tenant’s workloads in a multi-tenant environment (e.g. environment where different tenants’ workloads may share the same host) – such environment may be impacted by the recently discovered speculative execution vulnerabilities. Cloud Providers will need to apply VMware patches to the ESXi hosts as described in this article VMware Response to Speculative Execution security issues, CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 (aka Spectre and Meltdown).
 
Components such as operating systems (OS), virtual machines, virtual appliances, hypervisors, server firmware, and CPU microcode must all be patched or upgraded for effective mitigation of these vulnerabilities.
vCloud Director for Service Providers does not require patching and is not compromised.
  
The ESXi mitigation patches covered in the article VMware Response to Speculative Execution security issues, CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 (aka Spectre and Meltdown) can be safely applied to ESXi hosts managed by vCloud Director. Interoperability between vCloud Director and ESXi is not affected by the ESXi patches. There are no additional steps required in vCloud Director when patching ESXi.
 
Full interoperability matrix is available at VMware Product Interoperability Matrix.