The patch can be applied on ESXi hosts using VMware Update Manager (VUM) from vCenter.
VMware ESXi 6.7, Patch Release ESXi670-202206001
Proceed to the next section only after all hosts required to be patched are updated.
The VCF inventory has to be updated for every host on which the hot patch is applied via VUM as an asynchronous update of ESXi host will not update the host version in VCF inventory.
1. To update inventory, first capture the host id of each host on which patch was applied and version of ESXi patch used for update. To get host details from VCF inventory, login to SDDC Manager via SSH and run following command.
curl localhost/inventory/hosts | json_pp
Note: This returns list of all hosts. The field "id" in each host entry, corresponds to host id.
2. From the output, ensure to also note the version for each of the hosts.
3. Update the VCF inventory for each host on which patch was applied using following command
curl -X PATCH 'localhost/inventory/entities/<HOST_ID>' -d '{"version":"<ESXI_PATCH_VERSION>", "type":"ESXI"}' -H 'Content-Type:application/json'
<HOST_ID> Id of host for which version is to be updated in VCF inventory
<ESXI_PATCH_VERSION> Version of ESXi patch that was applied on hosts
Example:
<HOST_ID> - ########-####-####-####-########fde4
<ESXI_PATCH_VERSION> - 6.7.0-19898906
curl -X PATCH 'localhost/inventory/entities/########-####-####-####-########fde4' -d '{"version":"6.7.0-19898906", "type":"ESXI"}' -H 'Content-Type:application/json'
1. To update the version aliases execute the below command.
curl -k 'http://localhost/v1/system/settings/version-aliases/ESX_HOST/<Base version of ESXI host>' -X PUT -H 'Content-Type: application/json' -H 'Accept: application/json' -d '{"aliases" : [ "<Applied ESXI hot patch version>" ], "forceUpdate" : true}
<Base version of ESXI host> ESXI host version of latest release on which hot patch was installed.
<Applied ESXI hot patch version> The ESXI host version after successfully applying the hot patch.
Example:
<Base version of ESXI host> - 6.7.0-19195723
<Applied ESXI hot patch version> - 6.7.0-19898906
curl -k 'http://localhost/v1/system/settings/version-aliases/ESX_HOST/6.7.0-19195723' -X PUT -H 'Content-Type: application/json' -H 'Accept: application/json' -d '{"aliases" : [ "6.7.0-19898906" ], "forceUpdate" : true}'
After applying patches, the "forceHyperthreadingMitigation" advanced setting must be enabled in ESXi to mitigate CVE-2022-21123, CVE-2022-21125, and CVE-2022-21166.
See https://kb.vmware.com/s/article/88632 for details.