Download Patch ESX-8258730 for VMware ESX Server 3.0.1

Release Date: 9/6/07
Last Updated: 9/24/07

Summary

This patch provides the following security fixes:

• Fixes a security vulnerability that could allow a guest operating system user with administrative privileges to cause memory corruption in a host process, and thus potentially execute arbitrary code on the host. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the following name to this issue: CVE-2007-4496.
  
  Thanks to Rafal Wojtczvk of McAfee for identifying and reporting this issue.
  
  
• Fixes a denial of service vulnerability that could allow a guest operating system to cause a host process to become unresponsive or exit unexpectedly. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the following name to this issue: CVE-2007-4497.
  
  Thanks to Rafal Wojtczvk of McAfee for identifying and reporting this issue.

This patch also provides the following fixes:

• Fixes an issue where the user cannot delete the snapshot of a powered on virtual machine that has two disks with identical file names and/or on separate data stores. You must also install patch ESX-1000077 to complete the fix for this issue. Patches ESX-1000077 and ESX-8258730 can be installed in any order.
• Fixes an issue where the virtual machine panics as a result of exceeding the MAX_PIN_COUNT of the SCSI emulator driver. This panic occurs when a Windows XP SP2 virtual machine is created with an LSI Logic SCSI emulator driver. The fix increases the number of times a physical page can be pinned and optimizes the SCSI drivers to reduce the number of times a particular page is pinned.
• Fixes an issue where the connection between the ESX Server host and the VirtualCenter (or the ESX Server host and Virtual Infrastructure Client) is lost when reverting to a corrupted snapshot.

Symptoms

There are no symptoms available for the security fixes.

The following symptoms might be seen in systems without this patch:

• Deleting the snapshot of a virtual machine fails in the following scenario: Create a virtual machine that has two disks with identical names on separate datastores. Take a snapshot of the virtual machine. Deleting the snapshot fails with errors similar to the following:
  • Error in the virtual machine's uuid/VM-name/vmware.log: vmx| SNAPSHOT:GetConsolidateList failed 21
  • Error in the hostd logs: Failed to do Snapshot op: Error: The virtual disk is used multiple times hostd pulls this error message out of a foundry callback its snapshot callback.
• The virtual machine panic issue occurs during boot up. The virtual machine powers on only in safe mode and not in normal mode. Messages similar to the following might be logged:
  
  In /var/log/vmkernel:
  Dec 18 08:01:02 mltpsvm25 vmkernel: 9:19:09:05.571 cpu0:1257)WARNING: Heap: 1370: Heap_Align(vscsi, 72/72 bytes, 4 align) failed. caller: 0x726142
  Dec 18 08:01:02 mltpsvm25 vmkernel: 9:19:09:05.571 cpu0:1257)WARNING: VSCSI: 211: No memory available! Called from 0x726142
  
  In vmware.log:
  VA0050/vmware-2.log:Dec 10 17:12:21.759: vcpu-0| MONITOR PANIC: vcpu-0:NOT_IMPLEMENTED vmcore/vmm/main/busmem.c:984
  VA0050/vmware-3.log:Dec 10 17:14:49.411: vcpu-0| MONITOR PANIC: vcpu-0:NOT_IMPLEMENTED vmcore/vmm/main/busmem.c:984
  
  LSI: VMK call completed with bad status, 0xbad0014 CCB 0x0 targ 0x0 lun 0x0 cmd 0x0
  
  
• While creating a snapshot of a virtual machine, if the snapshot gets corrupted due to some reason, reverting to the snapshot crashes the ESX Server host management agent. An error message similar to the following gets logged in /var/log/vmware/hostd.log:SNAPSHOT:Unable to find all files for testvm-000001.vmdk
  

Impact

This patch resolves the symptoms discussed above and improves patch management activities on all ESX Server hosts. Command line usage of the tool has not changed, but custom scripts and third-party utilities could be affected by these changes.

View KB 8258730 for more information on this patch.

Download Instructions

Download and verify the patch bundle as follows :

1. Download patch ESX-8258730 by clicking on the link above.
2. Log in to the ESX Server service console as root.
3. Create a local depot directory.

   # mkdir -p /var/updates

   Note: VMware recommends that you use the updates directory.

4. Change your working directory to /var/updates.

   # cd /var/updates

5. Download the tar file into the /var/updates directory.
6. Verify the integrity of the downloaded tar file:

   # md5sum ESX-8258730.tgz
   
   The md5 checksum output should match the following:
   
   a06d0e36e403b0fe6bc6fbc76220a86d ESX-8258730.tgz

7. Extract the compressed tar archive:

   # tar -xvzf ESX-8258730.tgz

8. Change to the newly created directory, /var/updates/ESX-8258730:

   # cd ESX-8258730

Installation Instructions

Note: All virtual machines on the host must be either shut down or migrated using VMotion before applying the patch.

Once you have downloaded and extracted the archive, and if you are in the directory you created above, install the update using the following command:

# esxupdate update

To run esxupdate from a different directory, you must specify the bundle path in the command:

# esxupdate -r file://<directory>/ESX-8258730 update

for example, if the host is called depot:

# esxupdate -r file:///depot/var/updates/ESX-8258730 update

During the update process, logs appear on the terminal. You can specify the verbosity of esxupdate logs by using the -v option as shown below.

# esxupdate -v 10 file://<directory>/ESX-8258730 update

For more information on using esxupdate, refer to the Patch Management for ESX Server 3 tech note at http://www.vmware.com/pdf/esx3_esxupdate.pdf.