search for: meltdown

...Red Hat and all its derivatives. I asked CentOS community because that's the community I'm member of. Not to say that CentOS is not secure or anything like that. Anyway, I'm stuck with a few 32bit systems exposed to customers and I have to come up with an answer to their question about meltdown/spectre. At this point all I can say is that Red Hat hasn't patched 32bit systems but that is hard to believe so I assumed that I'm wrong and decided to ask the community. Thank you, -- Peter On Fri, Mar 9, 2018 at 7:52 AM, Johnny Hughes <johnny at centos.org> wrote: > I have...

I have a clean install, fully updated CentOS 6 32-bit. When I run the Red Hat detection script: https://access.redhat.com/sites/default/files/spectre-meltdown--a79614b.sh it finds that the system is vulnerable. Is this false positive or there is no patches for CentOS 6 32-bit systems? Thank you, -- Peter

By now, we're sure most everyone have heard of the Meltdown and Spectre attacks. If not, head over to https://meltdownattack.com/ and get an overview. Additional technical details are available from Google Project Zero. https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html The FreeBSD Security Team was notified of the issu...

By now, we're sure most everyone have heard of the Meltdown and Spectre attacks. If not, head over to https://meltdownattack.com/ and get an overview. Additional technical details are available from Google Project Zero. https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html The FreeBSD Security Team was notified of the issu...

What are the patches that I can download and install to be protected against the Meltdown and Spectre security vulnerabilities? ===BEGIN SIGNATURE=== Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 30 Oct 2017 [1] https://tdtemcerts.wordpress.com/ [2] http://tdtemcerts.blogspot.sg/ [3] https://www.scribd.com/user/270125049/Teo-En-Ming ===END SIGNATURE===

I've built & tagged packages for CentOS 6 and 7 4.6.6-9, with XPTI "stage 1" Meltdown mitigation. This will allow 64-bit PV guests to run safely (with a few caveats), but incurs a fairly significant slowdown for 64-bit PV guests on Intel boxes (including domain 0). If you prefer using Vixen / Comet, you can turn it off by adding 'xpti=0' to your Xen command-line. Detailed...

Hi everyone out there, I just found out that ssh command doesn't use DIRECT IO to open *.pem, which means private key goes to page cache, which means attacker may exploit meltdown to discover user's private key. I may come up with a POC for that if anybody is interested, I'm basing my work on the tool I created for checking whether system is vulnerable by exploiting MELTDOWN, follow it: https://github.com/raphaelsc/Am-I-affected-by-Meltdown Check strace output when...

Hi, I am very sorry to do this on short notice, but obviously Meltdown and Spectre are a lot more than anyone was really expecting to come down the pipeline. Xen 4.4 has been EOL upstream for about a year now and I have personally been reviewing and backporting patches based on the 4.5 versions made available upstream. Given that 4.5 is now also reaching EOL, backpo...

...l Message----- > From: CentOS-virt [mailto:centos-virt-bounces at centos.org] On Behalf Of > George Dunlap > Sent: Wednesday, January 17, 2018 9:14 AM > To: Discussion about the virtualization on CentOS <centos-virt at centos.org> > Subject: [CentOS-virt] Xen 4.6.6-9 (with XPTI meltdown mitigation) packages > making their way to centos-virt-xen-testing > > I've built & tagged packages for CentOS 6 and 7 4.6.6-9, with XPTI > "stage 1" Meltdown mitigation. > > This will allow 64-bit PV guests to run safely (with a few caveats), > but incurs a...

Does anyone know if Red Hat are working on backporting improved mitigation techniques and features from newer, 4.14.14+ kernels? $ grep . /sys/devices/system/cpu/vulnerabilities/* /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI /sys/devices/system/cpu/vulnerabilities/spectre_v1:Vulnerable /sys/devices/system/cpu/vulnerabilities/spectre_v2:Vulnerable: Minimal generic ASM retpoline $

I have built all the source code releases from upstream for RHEL-6 regarding meltdown /spectre and released those into packages into the CentOS Linux 6.9 updates repository. As to whether or not either Arch (x86_64 or i386) is or is not vulnerable, the CentOS team does not test for or make claims concerning security fitness. What we do build the source code that is released upstre...

On Fri, Mar 9, 2018 at 10:46 AM, Peter Wood <peterwood.sd at gmail.com> wrote: > Anyway, I'm stuck with a few 32bit systems exposed to customers and I have > to come up with an answer to their question about meltdown/spectre. At this > point all I can say is that Red Hat hasn't patched 32bit systems but that > is hard to believe so I assumed that I'm wrong and decided to ask the > community. According to a Q&A page about Meltdown and Spectre: Question - Is the patch available for 32 bit R...

...kemi Yagi <amyagi at gmail.com> wrote: > On Fri, Mar 9, 2018 at 10:46 AM, Peter Wood <peterwood.sd at gmail.com> > wrote: > > > Anyway, I'm stuck with a few 32bit systems exposed to customers and I > have > > to come up with an answer to their question about meltdown/spectre. At > this > > point all I can say is that Red Hat hasn't patched 32bit systems but that > > is hard to believe so I assumed that I'm wrong and decided to ask the > > community. > > According to a Q&A page about Meltdown and Spectre: > > Question...

...oose from, what would be the best option performance wise for running 32bit domUs under xen-4.6? Best, Peter On Wed, Jan 17, 2018 at 7:14 PM, George Dunlap <dunlapg at umich.edu> wrote: > I've built & tagged packages for CentOS 6 and 7 4.6.6-9, with XPTI > "stage 1" Meltdown mitigation. > > This will allow 64-bit PV guests to run safely (with a few caveats), > but incurs a fairly significant slowdown for 64-bit PV guests on Intel > boxes (including domain 0). > > If you prefer using Vixen / Comet, you can turn it off by adding > 'xpti=0' to...

...sage----- > From: CentOS-virt [mailto:centos-virt-bounces at centos.org] On Behalf Of > Peter Peltonen > Sent: Thursday, January 18, 2018 11:19 AM > To: Discussion about the virtualization on CentOS <centos-virt at centos.org> > Subject: Re: [CentOS-virt] Xen 4.6.6-9 (with XPTI meltdown mitigation) > packages making their way to centos-virt-xen-testing > > Thanks George. > > As there are now quite many options to choose from, what would be the > best option performance wise for running 32bit domUs under xen-4.6? > > Best, > Peter > It's worth...

....com/errata/RHSA-2018:0008 <https://access.redhat.com/errata/RHSA-2018:0008> Regards . G?tz > Am 19.02.2018 um 13:18 schrieb Turritopsis Dohrnii Teo En Ming <tdteoenming at gmail.com>: > > What are the patches that I can download and install to be protected > against the Meltdown and Spectre security vulnerabilities? > > ===BEGIN SIGNATURE=== > > Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 30 Oct 2017 > > [1] https://tdtemcerts.wordpress.com/ > > [2] http://tdtemcerts.blogspot.sg/ > > [3] https://www.scribd.com/user...

Has anyone applied patches to gluster storage node or fuse clients in an attempt to address Meltdown/Spectre issues? I'm curious if anyone has noticed or expects to see a performance impact. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.gluster.org/pipermail/gluster-users/attachments/20180117/28573776/attachment.html>

> -----Original Message----- > From: CentOS-virt [mailto:centos-virt-bounces at centos.org] On Behalf Of > Johnny Hughes > Sent: Wednesday, January 24, 2018 6:39 AM > To: centos-virt at centos.org > Subject: Re: [CentOS-virt] Xen 4.6.6-9 (with XPTI meltdown mitigation) > packages making their way to centos-virt-xen-testing > > On 01/24/2018 01:01 AM, Pasi K?rkk?inen wrote: > > On Tue, Jan 23, 2018 at 06:20:39PM -0600, Kevin Stange wrote: > >> On 01/23/2018 05:57 PM, Karl Johnson wrote: > >>> > >>> >...

Hi, > Hmm.. isn't this the ldisc bug that was discussed a few months ago on this list, > and a patch was applied to virt-sig kernel aswell? > > Call trace looks similar.. Good memory! I'd forgotten about that despite being the one who ran into it. Looks like that patch was just removed in 4.9.75-30 which I just upgraded this system to:

On 01/23/2018 05:57 PM, Karl Johnson wrote: > > > On Tue, Jan 23, 2018 at 4:50 PM, Nathan March <nathan at gt.net > <mailto:nathan at gt.net>> wrote: > > Hi, > > > Hmm.. isn't this the ldisc bug that was discussed a few months ago on this > list, > > and a patch was applied to virt-sig kernel aswell? > > >