Q) vTM can be affected by CPU issue about Meltdown and Spectre

[yihwang]

Hi.

I'm a vTM engineer.

After reading KB43597,

I was wondering if vTM can be affected by same issue,

because there is no word about vTM.

Please let me know as possible.

Thanks in advance

yeongil

[pwallace]

Hello, the KB has now been updated to include vADC (including vTM, vWAF and Services Director)

https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB43597/?l=en_US&fs=Search&pn=1&atype

These exploits are unusual in that the vulnerability is not in the software itself, but is in the underlying HW platform and could allow HW memory protection and isolation to be circumvented with application-level code.

[yihwang]

Hello.

vTM was deployed on ESXi. Did you mean that there is no problem by applying ESXi patch?

Thanks in advance

Regards,

yihwang

[pwallace]

You will certainly need the ESXi patch to mitigate these HW vulnerabilities.

However, these side-channel vulnerabilities are complex, and may also depend on the interaction with the underlying hardware. As per the KB article linked above, we are also considering further mitigation options, which may include updating the vTM Virtual Appliance to implement additional patches from the OS Vendor.

As mentioned in the KB, please refer to https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown for additional information on the delivery of the patches from the OS vendor; this link may also provide ongoing recommendations and best practice.