virt June 2019

virt@lists.centos.org

5 participants
3 discussions

Start a nNew thread

Are XSA-289, XSA-274/CVE-2018-14678 fixed ?
by Yuriy Kohut 01 Jul '19

01 Jul '19

Hello, Are XSA-289 and XSA-274/CVE-2018-14678 fixed with Xen recent 4.8, 4.10 and kernel 4.9.177 packages ? Thank you

2 2

centos7.6 nvme support
by jack.chen 25 Jun '19

25 Jun '19

Hello: I create a centos7.6 virtual machine which use 3.10.0-957 kernel，using pci passthrough to support nvme device； and I found interrupt can not distribute to target CPU which in smp_affinity set，the problem solved when I update kernel to 5.0.20,is anyone can tell me how to solve this problem without updating kernel?? thanks advance!!

2 1

Speculative attack mitigations
by Jonathan Archdale - Blacknight 12 Jun '19

12 Jun '19

Hi folks, Firstly; apologies in advance for what is a head wrecker of keeping on top of the speculative mitigations and also if this is a duplicate email; my first copy didn't seem to make it into the archive. Also a disclaimer that I may have misunderstood elements of the below but please bear with me. I write this hoping to find out a bit more about the state of the relevant kernel patches for the various speculative attack mitigations in the current 4.9.177-35 kernel used in the centos-virt tree. For reference; I am running a Dell R620, using an E5-2620 v2 CPU, using 4.9.177-35 from the xen-410 tree in the EL6 branch ; though I am still using xen 4.6 at this time. I have been told in the irc channel that the kernel is not built against a specific version of xen so this should make no odds. As per https://www.dell.com/support/home/ie/en/iebsdt1/drivers/driversdetails?driv… - bios version 2.70 (installed) contains mitigations for CVE-2018-3639 (variant 3a route system register read) and CVE-2018-3640 (variant 4, speculative store bypass). I am also running the latest available intel microcode for the CPU; as imported via 'module /GenuineIntel.bin' and 'ucode=2' in my grub.conf to import (as taken from https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files). # uname -r 4.9.177-35.el6.x86_64 # cat /proc/cmdline ro root=UUID=0e51d8dc-6409-4715-83f4-f86fa24083e2 rd_NO_LUKS KEYBOARDTYPE=pc KEYTABLE=uk LANG=en_US.UTF-8 rd_NO_MD nodmraid SYSFONT=latarcyrheb-sun16 crashkernel=auto rd_NO_LVM rd_NO_DM rhgb quiet intel_idle.max_cstate=0 processor.max_cstate=0 l1ft=full mds=full,nosmt ssbd=force-on # grep -e flags -e "model name" -e microcode -e bugs /proc/cpuinfo | sort -u model name : Intel(R) Xeon(R) CPU E5-2620 v2 @ 2.10GHz microcode : 0x42e flags : fpu de tsc msr pae mce cx8 apic sep mca cmov pat clflush acpi mmx fxsr sse sse2 ss ht syscall nx lm constant_tsc arch_perfmon rep_good nopl nonstop_tsc pni pclmulqdq monitor est ssse3 cx16 sse4_1 sse4_2 popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm fsgsbase erms xsaveopt dtherm ida arat pln pts bugs : cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds You will note that there is a lack of flags for ssbd, spec_ctrl, intel_stibp, flush_l1d, ibrs, etc. # for i in /sys/devices/system/cpu/vulnerabilities/* ; do echo -n "$i : "; cat $i ; done /sys/devices/system/cpu/vulnerabilities/l1tf : Mitigation: PTE Inversion /sys/devices/system/cpu/vulnerabilities/mds : Vulnerable: Clear CPU buffers attempted, no microcode; SMT Host state unknown /sys/devices/system/cpu/vulnerabilities/meltdown : Vulnerable /sys/devices/system/cpu/vulnerabilities/spec_store_bypass : Vulnerable /sys/devices/system/cpu/vulnerabilities/spectre_v1 : Mitigation: __user pointer sanitization /sys/devices/system/cpu/vulnerabilities/spectre_v2 : Mitigation: Full generic retpoline, STIBP: disabled, RSB filling Despite having relevant microcode, I am still seeing the box as showing vulnerable to meltdown, speculative store bypass (ssbd), as well as MDS via MD_CLEAR mitigation. When I mount the debugfs, the flag for ibrs is missing - preventing me enabling it as a mitigation for ssbd (due to lack of relevant cpu flag): # mount -t debugfs none /sys/kernel/debug/ # ls -lahtr /sys/kernel/debug/x86/ibrs_enabled ls: cannot access /sys/kernel/debug/x86/ibrs_enabled: No such file or directory I have other R620's with the same CPUs running stock el6 kernels that are showing as fully patched to these issues. Could I please get some feedback from whoever builds out the kernels; if the mitigations/patches are in place in the 4.9.177-35 kernel for the various speculative mitigations? Specifically; CVE-2018-3639, CVE-2018-3640, CVE-2018-3646, CVE-2018-12126, CVE-2018-12130, CVE-2018-12127 and CVE-2019-11091. Many thanks for your response. Regards, Jonathan

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

virt June 2019