Understanding L1 Terminal Fault Mitigation

Posted by Paul Braren on Aug 15 2018 (updated on Aug 20 2018) in
  • ESXi
  • Virtualization
  • Security

    • This article is a summary of a newly disclosed CPU vulnerability. It's a little like Spectre and Meltdown, but it's also quite different, as is the PowerShell based remediation for VMware Hypervisor. I tried to summarize the explainer articles and videos in my series of my tweets from @paulbraren today. Getting things described in just a few words isn't exactly easy for me, so I went with several tweets. I'm certainly no expert on this topics, but I did find it interesting how well orchestrated yesterday's reveal of this new set of vulnerabilities was, across the industry. This article is just a starting point in seeking a fuller understanding of what these new CPU vulnerabilities will mean to IT Professionals, especially in a shared hosting/cloud environment. I hope you find this information helpful!

    Aug 20 2018 Update

    L1TF [AKA Foreshadow] Explained in 3 Minutes from Red Hat

    Screenshots

    VMware's latest ESXi Build 9484548 Host Client view clearly discloses the potential issue to the sysadmin at first login, right after patching:

    2018-08-15_23-12-59

    This host is potentially vulnerable to issues described in CVE-2018-3646, please refer to https://kb.vmware.com/s/article/55636 for details and VMware recommendations.

    Video

    Understanding L1 Terminal Fault [L1TF]

    Intel Newsroom YouTube Channel video description:

    Intel Newsroom
    Published on Aug 14, 2018
    Learn more about the speculative execution side-channel method called L1 Terminal Fault (L1TF). There are three applications of L1TF speculative execution side-channel cache timing vulnerabilities. They are similar to previously reported variants. These particular methods target access to the L1 data cache, a small pool of memory within each processor core designed to store information about what the processor core is most likely to do next.

    Microcode updates released by Intel are an important component of the mitigation strategy for all three applications of L1TF. When coupled with corresponding updates to operating system and hypervisor software from industry partners and the open source community, these updates help ensure that consumers, IT professionals and cloud service providers have access to the protections they need.

    Learn more about L1TF at https://newsroom.intel.com/editorials/protecting-our-customers-through-lifecycle-security-threats/

    See also at TinkerTry

    easy-update-to-latest-esxi

    meltdown-and-spectre-info

    TinkerTry - PCs, EVs, home tech, efficiency and more, including virtualization. My opinions here, not my employer's.

    Paul Braren, MCSE in 1998, VCP #2681 in 2005, vExpert 2014 to 2024, Veeam Vanguard Emeritus, 2015 to 2019.

    Support TinkerTry

    PayPal | Patreon | VMware Store

    After 6 successful years testing then shipping well over 1,000 Xeon D Bundles, Wiredzone had to stop selling them in mid-2021 due to cost, supply, and logistics challenges. So far, Xeon D-1700/2700 (Ice Lake D) was a minor refresh for 2023, with Xeon D-1800/2800 (Granite Rapids D) refresh looking a little better for 2024. More cores, but still just PCIe Gen4 and DDR4. Looking ahead, I'm glad it's Pat Gelsinger at Intel's helm. I'm also grateful to have had the honor of working at VMware when Pat was the CIO there. I'll leave it at that, given the whole Broadcom thing.

    Easily update VMware ESXi at TinkerTry.com/easy-update-to-latest-esxi