Upgrade path to fix CVE on an ESXi with a Cisco Custom Image

[battagls]

Hello.

I our Organization we have Cisco UCS C240 M5S servers with these sw installed:

• Firmware Version: 4.2(3i)
• ESXi Version: 7.0 Update 3i

Currently the latest custom version of ESXi 7.0 available for download is 7.0 Update 3o (File name: "VMware-ESXi-7.0.3o-22348816-Custom-Cisco-4.3.2-a.1").

Meanwhile, vulnerabilities with high severity have been published: these vulnerabilities are fixed in the ESXi 7.0 Update 3q (no Custom) version. As written earlier the latest Cisco Custom version is Update 3o, which is earlier than the image that fixes the vulnerabilities.

I have read in other threads that it is possible to update an ESXi with Custom Image with a non-Custom image.

At this point my question is, what is the upgrade path I need to follow to fix my ESXi servers?

I was thinking of a path like this:

1. Update fw: Update firmware from version 4.2(3i) to the latest released, 4.3(2.240053) 
2. Update ESXi: Update ESXi from Cisco Custom version 7.0 Update 3i to non-Custom version 7.0 Update 3q
3. Update drivers: Update ESXi driver with Cisco Addon for ESXi 7.0 U3o

Based on your experience, do you think this path is correct?

Finally, once I have upgraded the ESXi with a non-Custom version can I upgrade the ESXi with a Custom version?

Thank you.

Regards.

Sergio

[Riaan van Niekerk]

Hi there Sergio. You refer to custom image. There are 2 custom distribution mechanisms for ESXi:

1. Vendor custom ISO, can be used for installation only
2. Vendor custom offline bundle (.zip) which should be used for upgrades.

Are you still using the (deprecated in vSphere 8.0) vLCM baselines and baseline group based, or have you switched to using vLCM Image-based updates, the Cisco vendor add-on).

[battagls]

Hello.

Thank you for your response.
No, we don't use vLCM: we have few servers in our environment, and last time I did the server upgrade by uploading the ISO via CIMC.
To install this update I was thinking to use the offline bundle (.zip file) by installing the package via CLI.

[Riaan van Niekerk]

Your upgrade plan seems sound. The only change I would make is, If you cannot upgrade server firmware at the same time as drivers and ESXi (e.g. have the firmware upgrade pending on next reboot), I would strongly recommend that you upgrade drivers first (with / without ESXi) before upgrading server firmware. 

In our experience over the past decade plus, newer drivers with older server firmware do not cause an issue. 

What you want to avoid is your scenario, running newer server firmware (e.g. 4.3.x) with drivers that have been certified with 4.2.x server firmware.

[Riaan van Niekerk]

(deleted)