Re: [CentOS-virt] Are XSA-289, XSA-274/CVE-2018-14678 fixed ?

Looks like this never got a response from anyone.

On 6/25/19 10:15 AM, Yuriy Kohut wrote:

Hello,

Are XSA-289 and XSA-274/CVE-2018-14678 fixed with Xen recent 4.8, 4.10 and kernel 4.9.177 packages ?

XSA-289 is a tricky subject. In the end, it was effectively decided that these patches were not recommended until they were reviewed again and XSA-289 has no official list of flaws or fixes as a result. The main mitigation action suggested is to disable SMT on the CPU if possible.

XSA-274 was patched into Linux 4.9 almost a year ago:

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...

That's 4.9.124, so yes, 4.9.177 has it.