vRanger virtual appliance Meltdown and Spectre Side Channel Vulnerabilities (4040904)

• Meltdown - CVE-2017-5754 is the most severe of the three. This exploit uses speculative cache loading to enable a local attacker to read the contents of memory. This issue is corrected with kernel patches.

• Spectre - CVE-2017-5753 is a Bounds-checking exploit during branching. This issue is corrected with a kernel patch.

• Spectre - CVE-2017-5715 is an indirect branching poisoning attack that can lead to data leakage. This attack allows for a virtualized guest to read memory from the host system. This issue is corrected with microcode, along with kernel and virtualization updates to both guest and host virtualization software.

The vRanger Virtual Appliance is not affected because there is no available path to execute arbitrary code without administrative privileges. However, we highly recommend installing the OS updates and firmware upgrades in order to avoid any security breach. 

These advisories have additional information about how to mitigate these vulnerabilities:

• Intel: Side-Channel Analysis Facts and Intel® Products
• AMD Processors: Google Project Zero, Spectre and Meltdown
• Microsoft: Guidance to mitigate speculative execution side-channel vulnerabilities
• VMware: Security Advisory VMSA-2018-0002.3

The virtual appliance Linux kernel has been updated in vRanger version 7.6.5 in order to address these CVE's.

You can download the latest vRanger Backup & Replication releases here.