Knowledge Base

Search the Knowledge Base:
Products:
Search In:
 

ESX Server 3.0.1, Patch ESX-8258730: Security Updates, Updates to Monitor and LSI Logic SCSI Emulator Driver

Details

Release Date: 9/6/07
Last Updated: 9/24/07
 
 
Download Now
Download Size: 52.5 MB
Download Filename:
ESX-8258730.tgz
md5sum:
a06d0e36e403b0fe6bc6fbc76220a86d
Product Versions ESX Server 3.0.1
Patch Classification Security
Superceded By None
Virtual Machine Migration or Reboot Required Yes
ESX Server Host Reboot Required No
Affected Hardware N/A
Affected Software Third-party patch management or custom patch management scripts might be affected.
RPMs Updated VMware-esx-vmx
Related CVE numbers CVE-2007-4496, CVE-2007-4497

Summary

This patch provides the following security fixes:
  • Fixes a security vulnerability that could allow a guest operating system user with administrative privileges to cause memory corruption in a host process, and thus potentially execute arbitrary code on the host. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the following name to this issue: CVE-2007-4496.

    Thanks to Rafal Wojtczvk of McAfee for identifying and reporting this issue.
  • Fixes a denial of service vulnerability that could allow a guest operating system to cause a host process to become unresponsive or exit unexpectedly. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the following name to this issue: CVE-2007-4497.

    Thanks to Rafal Wojtczvk of McAfee for identifying and reporting this issue.

This patch also provides the following fixes:

  • Fixes an issue where the user cannot delete the snapshot of a powered-on virtual machine that has two disks with identical file names and/or on separate data stores. You must also install patch ESX-1000077 to complete the fix for this issue. Patches ESX-1000077 and ESX-8258730 can be installed in any order.
  • Fixes an issue where the virtual machine panics as a result of exceeding the MAX_PIN_COUNT of the SCSI emulator driver. This panic occurs when a Windows XP SP2 virtual machine is created with an LSI Logic SCSI emulator driver. The fix increases the number of times a physical page can be pinned and optimizes the SCSI drivers to reduce the number of times a particular page is pinned.
  • Fixes an issue where the connection between the ESX Server host and the VirtualCenter (or the ESX Server host and Virtual Infrastructure Client) is lost when reverting to a corrupted snapshot.


    Note: VMware-esx-tools is included with this patch due to dependency requirements.

Solution

Symptoms

There are no symptoms available for the security fixes.

For the other fixes, the following symptoms might be seen in systems without this patch:
  • Deleting the snapshot of a virtual machine fails in the following scenario: Create a virtual machine that has two disks with identical names on separate datastores. Take a snapshot of the virtual machine. Deleting the snapshot fails with errors similar to the following:
    • Error in the virtual machine's uuid/VM-name/vmware.log : vmx| SNAPSHOT:GetConsolidateList failed 21
    • Error in the hostd logs: Failed to do Snapshot op: Error: The virtual disk is used multiple times hostd pulls this error message out of a foundry callback its snapshot callback.
  • The virtual machine panic issue occurs during boot up. The virtual machine powers on only in safe mode and not in normal mode. Messages similar to the following might be logged:

    In     /var/log/vmkernel     :
    Dec 18 08:01:02 mltpsvm25 vmkernel: 9:19:09:05.571 cpu0:1257)WARNING: Heap: 1370: Heap_Align(vscsi, 72/72 bytes, 4 align) failed. caller: 0x726142
    Dec 18 08:01:02 mltpsvm25 vmkernel: 9:19:09:05.571 cpu0:1257)WARNING: VSCSI: 211: No memory available! Called from 0x726142

    In vmware.log :
    VA0050/vmware-2.log:Dec 10 17:12:21.759: vcpu-0| MONITOR PANIC: vcpu-0:NOT_IMPLEMENTED vmcore/vmm/main/busmem.c:984
    VA0050/vmware-3.log:Dec 10 17:14:49.411: vcpu-0| MONITOR PANIC: vcpu-0:NOT_IMPLEMENTED vmcore/vmm/main/busmem.c:984

    LSI: VMK call completed with bad status, 0xbad0014 CCB 0x0 targ 0x0 lun 0x0 cmd 0x0

  • While creating a snapshot of a virtual machine, if the snapshot gets corrupted due to some reason, reverting to the snapshot crashes the ESX Server host management agent.  An error message similar to the following gets logged in /var/log/vmware/hostd.log : SNAPSHOT:Unable to find all files for testvm-000001.vmdk

Impact

This patch resolves the symptoms discussed above and improves patch management activities on all ESX Server hosts. Command line usage of the tool has not changed, but custom scripts and third-party utilities could be affected by these changes.

Download Instructions

Download and verify the patch bundle as follows:

  1. Download patch ESX-8258730 by clicking on the link above.

  2. Log in to the ESX Server service console as root.

  3. Create a local depot directory.

    # mkdir -p /var/updates

    Note: VMware recommends that you use the updates directory.

  4. Change your working directory to /var/updates.

    # cd /var/updates

  5. Download the tar file into the /var/updates directory.

  6. Verify the integrity of the downloaded tar file:

    # md5sum ESX-8258730.tgz

    The md5 checksum output should match the following:

    a06d0e36e403b0fe6bc6fbc76220a86d ESX-8258730.tgz

  7. Extract the compressed tar archive:

    # tar -xvzf ESX-8258730.tgz

  8. Change to the newly created directory, /var/updates/ESX-8258730:

    # cd ESX-8258730

Installation Instructions

Note: All virtual machines on the host must be either shut down or migrated using VMotion before applying the patch.
 
After you have downloaded and extracted the archive, and if you are in the directory you created above, install the update using the following command:

# esxupdate update

To run esxupdate from a different directory, you must specify the bundle path in the command:

# esxupdate -r file://<directory>/ESX-8258730 update

For example, if the host is called depot:

# esxupdate -r file:///depot/var/updates/ESX-8258730 update

During the update process, logs appear on the terminal. You can specify the verbosity of esxupdate logs by using the -v option as shown below.

# esxupdate -v 10 file://<directory>/ESX-8258730 update

For more information on using esxupdate, refer to the Patch Management for ESX Server 3 tech note at http://www.vmware.com/pdf/esx3_esxupdate.pdf.

Keywords

esxpatch;esx301;alertz;urlz

Feedback

Rating: 1 - Lowest 2 3 4 5 - Highest (0 Ratings)   

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.
What can we do to improve this information? (2000 or fewer characters)
Submit
Rating: 1 - Lowest 2 3 4 5 - Highest (0 Ratings)   
Actions
  • KB Article: 8258730
  • Updated: Aug 14, 2009
  • Products:
    VMware ESX
  • Product Versions:
    VMware ESX 3.0.x