Hello,
Are XSA-289 and XSA-274/CVE-2018-14678 fixed with Xen recent 4.8, 4.10 and kernel 4.9.177 packages ?
Thank you
Looks like this never got a response from anyone.
On 6/25/19 10:15 AM, Yuriy Kohut wrote:
Hello,
Are XSA-289 and XSA-274/CVE-2018-14678 fixed with Xen recent 4.8, 4.10 and kernel 4.9.177 packages ?
XSA-289 is a tricky subject. In the end, it was effectively decided that these patches were not recommended until they were reviewed again and XSA-289 has no official list of flaws or fixes as a result. The main mitigation action suggested is to disable SMT on the CPU if possible.
XSA-274 was patched into Linux 4.9 almost a year ago:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
That's 4.9.124, so yes, 4.9.177 has it.
Hello Kevin,
Thank you in advance for the reply. Will mark XSA-274 as fixed for us.
On Jun 28, 2019, at 6:47 PM, Kevin Stange kevin@steadfast.net wrote:
Looks like this never got a response from anyone.
On 6/25/19 10:15 AM, Yuriy Kohut wrote:
Hello,
Are XSA-289 and XSA-274/CVE-2018-14678 fixed with Xen recent 4.8, 4.10 and kernel 4.9.177 packages ?
XSA-289 is a tricky subject. In the end, it was effectively decided that these patches were not recommended until they were reviewed again and XSA-289 has no official list of flaws or fixes as a result. The main mitigation action suggested is to disable SMT on the CPU if possible.
XSA-274 was patched into Linux 4.9 almost a year ago:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
That's 4.9.124, so yes, 4.9.177 has it.
-- Kevin Stange Chief Technology Officer Steadfast | Managed Infrastructure, Datacenter and Cloud Services 800 S Wells, Suite 190 | Chicago, IL 60607 312.602.2689 X203 | Fax: 312.602.2688 kevin@steadfast.net | www.steadfast.net
-
Kevin Stange -
Yuriy Kohut