<?xml version="1.0" encoding="utf-16"?><html><head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
<style id="css_styles" type="text/css"><!--blockquote.cite { margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc }
blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding-top: 0px; }
a img { border: 0px; }
ol, ul { list-style-position: inside }
body { font-family: Tahoma; font-size: 12pt; }--></style></head>
<body><div>4.9.75-30 works in my dev environment for CentOS 6.</div><div><br /></div><div>[root@devhost1 ~]# uname -a</div><div>Linux devhost1.servers.provps.com 4.9.75-30.el6.x86_64 #1 SMP Fri Jan 5 20:58:49 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux</div><div><br /></div><div><br /></div><div id="signature_old"><div style="FONT-SIZE: 12pt; FONT-FAMILY: Tahoma">
<div>--</div>
<div>Shaun Reitan</div>
<div>NDCHost.com</div></div></div><div><br /></div>
<div>------ Original Message ------</div>
<div>From: "Johnny Hughes" <<a href="mailto:johnny@centos.org">johnny@centos.org</a>></div>
<div>To: <a href="mailto:centos-virt@centos.org">centos-virt@centos.org</a></div>
<div>Sent: 2018-01-06 02:09:12 AM</div>
<div>Subject: Re: [CentOS-virt] CentOS-virt - Kernel Side-Channel Attacks</div><div><br /></div>
<div id="x179c9f809363441" class="plain"><blockquote cite="ad1b847d-0d93-1d95-d5d7-9ddc801943d5@centos.org" type="cite" class="cite2">
<tt style="word-wrap:break-word"><div>On 01/05/2018 06:33 AM, George Dunlap wrote:</div>
<blockquote type="cite" class="cite">
<div> On Thu, Jan 4, 2018 at 7:12 PM, Sarah Newman <<a href="mailto:srn@prgmr.com">srn@prgmr.com</a>> wrote:</div>
<blockquote type="cite" class="cite">
<div> On 01/04/2018 10:49 AM, Akemi Yagi wrote:</div>
<blockquote type="cite" class="cite">
<div> On Thu, Jan 4, 2018 at 9:51 AM, <<a href="mailto:rikske@deds.nl">rikske@deds.nl</a>> wrote:</div>
<div> </div>
<blockquote type="cite" class="cite2">
<div> Please patch the CentOS-virt Kernel to fix the</div>
<div> Kernel Side-Channel Attacks vulnerabilities.</div>
<div> </div>
<div> The latest CentOS-virt kernel was released in November, as seen below.</div>
<div> </div>
<div> kernel-4.9.63-29.el7.x86_64.rpm 2017-11-21 13:30</div>
<div> </div>
<div> <a href="https://access.redhat.com/security/vulnerabilities/speculativeexecution">https://access.redhat.com/security/vulnerabilities/speculativeexecution</a></div>
<div> <a href="http://mirror.centos.org/centos/7/virt/x86_64/xen/">http://mirror.centos.org/centos/7/virt/x86_64/xen/</a></div>
<div> </div>
</blockquote>
<div> </div>
<div> As far as I can see, the patches for</div>
<div> KAISER (Kernel Address</div>
<div> Isolation to have Side-channels Efficiently Removed) will appear in</div>
<div> kernel 4.9.75. Looks like it will be released soon upstream (kernel.org).</div>
<div> </div>
</blockquote>
<div> </div>
<div> To my best knowledge KAISER doesn't matter for Xen Dom0's given they run in PV mode, and KAISER isn't enabled for PV guests.</div>
</blockquote>
<div> </div>
<div> But it will be important if anyone is running the CentOS kernel in</div>
<div> their HVM domUs (as guest kernels can be attacked using SP3 by guest</div>
<div> user space without the KPTI patches).</div>
<div> </div>
<div> I'm sure Johnny will get to it as soon as he has the opportunity.</div>
</blockquote>
<div> </div>
<div>I have just pushed the 4.9.75-29.el7 and 4.9.75-30.el6 kernels to the</div>
<div>testing repositories.</div>
<div> </div>
<div> </div>
<div><a href="https://buildlogs.centos.org/centos/7/virt/x86_64/xen/">https://buildlogs.centos.org/centos/7/virt/x86_64/xen/</a></div>
<div> </div>
<div>and</div>
<div> </div>
<div><a href="https://buildlogs.centos.org/centos/6/virt/x86_64/xen/">https://buildlogs.centos.org/centos/6/virt/x86_64/xen/</a></div>
<div> </div>
<div>xen, xen-44, xen-46, xen-48 repos should all get the rpms (not just xen)</div>
<div>.. el6 has yet to post there, but it is tagged and should show up in a</div>
<div>couple hours. The kernel is already there in the el7 trees.</div>
<div> </div>
<div>We need lots of testing .. the configuration name is now:</div>
<div> </div>
<div>CONFIG_PAGE_TABLE_ISOLATION=y</div>
<div> </div>
<div>(instead of CONFIG_KAISER)</div>
<div> </div>
<div>Please test these kernels so we can release them .. it boots for me as a</div>
<div>Dom0 kernel and I can start PVHVM and HVM CentOS DomU machines .. which</div>
<div>is how I test before I move the kernels to the testing repos.</div>
<div> </div>
<div> </div>
</tt></blockquote></div>
</body></html>