VMware Skyline Advisor Pro releases new proactive Findings every month. Findings are prioritized by trending issues in VMware Technical Support, issues raised through post escalation review, security vulnerabilities, issues raised from VMware engineering, and nominated by customers.
For the month of October, we released 39 new Findings. Of these, there are 30 Findings based on trending issues, 4 based on post escalation reviews, 3 based on VMSA, and 1 based on nominations. We picked a few of these Findings from each of these categories which stand out in this release.
Security Vulnerabilities
In VMSA-2023-0023, vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol (CVE-2023-34048). A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution. vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data (CVE-2023-34056). These vulnerabilities are addressed in VMware vCenter 8.0 U2, 8.0 U1d, 7.0 U3o, 6.7 U3t, and 6.5 U3v.
- vSphere-CVE-2023-34048-34056-VMSA#202318
Post Escalation Review
VMware Technical Support has developed a Post Escalation Review process. We review critical escalations which come into our Escalation Management team and determine steps to prevent these escalations in the future with other customers. One of the outcomes of this process is the creation of Skyline Findings.
In KB#94738, environments with ESXi hosts configured with the same MAC address for VMNIC0 can experience metadata corruption. This is one of many issues which can happen with this configuration. Other issues include VMs crashing and/or going inaccessible/orphaned, VM deployments fail, and ESXi hosts PSODing. ESXi uses the MAC address when defining its UUID. For VMFS/VMFSD operations, this UUID is written to the metadata. When an ESXi host checks that metadata (Heartbeats, journals, file locks, etc.) it validates against the last octet of the UUID, which is the MAC address for vmnic0, to understand who the owner is. To prevent this issue please ensure the physical NICs in ESXi hosts are using unique MAC addresses.
- vSphere-DuplicateMAC-KB#94738
- Using the same MAC address for vmnic0 across multiple ESXi hosts in the same cluster will lead to VMFS and vSAN (VMFSD) metadata corruption.
- https://kb.vmware.com/s/article/94738
- Critical
Findings Nominated from Customers
The Skyline team’s primary focus is customer satisfaction. We want to keep customers out of harm’s way, and we do this by providing you with Findings we discover from the day-to-day business of VMware Technical Support. We also want to hear ideas of what you would like to see in Skyline Advisor Pro. The following Finding came from one of our customers:
In KB#92858, ESXi 7.0 hosts goes “not responding” in vCenter and automatically recovers a few minutes later. This issue is caused by race conditions between the power-off operation on the VM and the actual moment when the Vigor callbacks are invoked. As a result, the infinite loop can make hostd to consume memory by hard limit. This issue is resolved in VMware ESXi 7.0 Update 3o (build number 22348816)
- vSphere-Memoryexceedshardlimit-KB#92858
If you would like to nominate an idea for a Skyline Finding, please follow the Provide Feedback directions to nominate Findings.
VMware Technical Support Trending Issues
VMware Technical Support trending issues are KBs that have solved many SRs and/or are viewed many times.
In KB#91537, the vCenter’s performance will deteriorate and it might become unresponsive. This issue occurs due to a memory leak within the VMware authentication framework. This issue is resolved in vCenter Server 7.0 Update 3L (build number 21477706).
- vSphere- vmafddmemory-KB#91537
- VMware Authentication framework (vmafdd) memory consumption gradually increases and drives the vCenter’s (7.x) overall memory consumption higher.
- https://kb.vmware.com/s/article/91537
- Moderate
To review all released Findings for the month of October and all current active VMware Skyline Findings please go to the VMware Skyline Findings Catalog.
Most Viewed Findings in Last 30 Days
Below are the most viewed Findings by users in Skyline Advisor Pro:
- vSphere-VMmorethan3snapshots-KB#1025279
- vSphere-VCFEsxNTPRule-KB#81647
- vSphere-CustomizeWindowsGuests-KB#1020716
- NSXv-EdgeSSH100percentdiskusage-KB#2150467
- vSphere-vMotionJumboFrames-KB#2120640
- vSphere-StoragevMotion-KB#88957
- vSphere-PSODFastSlabAlloc-KB#90052
- vSphere-VCFEsxRemoteSysLogRule-KB#81648
- vSphere-VMsnapshotover7days-KB#1025279
- Horizon-Log4jremotecodeexe-VMSA#202128
- vSphere-vmsupportCNAFCoELinkDown-KB#2142226
- vSphere-SpectreMeltdown-VMSA#201804-2
- vSphere-PSODFastSlabAllocSlow-KB#89131
- vSphere-VmUnresponsivememoryleak-KB#2077302
- vSphere-Portsexhausted-KB#54459
- vSphere-PSODPktListPop-KB#87489
- vSphere-CVE-2022-31676-VMSA#202224
- vSphere-VPXDcrashes-KB#90710
- vSAN-Diskfailures-KB#2108691
- vSphere-EndpointCertExpiration-KB#2097936
- vSphere-HostDisconnects-KB#2144799
- vSphere-over1TBvm-KB#79520
- vSphere-opentools-31676-VMSA#202224
- vSphere-L1TerminalFault-VMSA#201820-3
- NSXT-EndpointCertExpiration-KB#89921