VMware ESXi 6.5, Patch ESXi650-201703410-SG: Updates esx-base, vsanhealth, vsan VIBs

Products

• VMware vSphere ESXi

Issue/Introduction

Release date: Mar 28, 2017

 

 

Patch Category	Security
Patch Severity	Critical
Build	For build information, see KB 2149572.
Host Reboot Required	Yes
Virtual Machine Migration or Shutdown Required	Yes
Affected Hardware	N/A
Affected Software	N/A
VIBs Included	VMware_bootbank_esx-base_6.5.0-0.15.5224529 VMware_bootbank_vsan_6.5.0-0.15.5224529 VMware_bootbank_vsanhealth_6.5.0-0.15.5224529
PRs Fixed	N/A
Related CVE numbers	CVE-2017-4902, CVE-2017-4903, CVE-2017-4904, CVE-2017-4905

 

Environment

VMware vSphere ESXi 6.5

Resolution

Summaries and Symptoms

This patch updates the esx-base VIB to resolve the following issues:

• ESXi has a heap buffer overflow and uninitialized stack memory usage in SVGA. These issues may allow a guest VM to execute code on the host. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2017-4902 (heap issue) and CVE-2017-4903 (stack issue) to these issues.
• The ESXi XHCI controller has uninitialized memory usage. This issue may allow a guest VM to execute code on the host. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4904 to this issue.
• ESXi has uninitialized memory usage. This issue may lead to an information leak. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4905 to this issue.

Patch Download and Installation

The typical way to apply patches to ESXi hosts is through the VMware vSphere Update Manager. For details, see the Installing and Administering VMware vSphere Update Manager.

 

ESXi hosts can be updated by manually downloading the patch ZIP file from the VMware download page and installing the VIB by using the esxcli software vib command. Additionally, the system can be updated using the image profile and the esxcli software profile command. For details, see the vSphere Command-Line Interface Concepts and Examples and the vSphere Upgrade Guide.