To provide more detailed information about the Meltdown and Spectre vulnerabilities, to complement the advisory, SVG:Advisory-SVG-CVE-2017-5753.
This was compiled in January and early February 2018
Information including more recent SVG Speculative execution vulnerabilities
These are vulnerabilities in the design of the chip hardware, and cannot be fully resolved by patching operating systems. However patches are available which mitigate these problems.
For more details, see Meltdown attack, Spectre attack and Project zero: Reading privileged memory with side
Each CVE can be mitigated via different ways:
As of Feb 2nd 2018, RedHat has offered new kernel updates that can mitigate Meltdown (CVE-2017-5754), Spectre Variant 1 (CVE-2017-5753) and Spectre Variant 2 (CVE-2017-5715), see their page on Speculative Execution.
However, due to instability issues, it has removed the microcode updates required for Spectre Variant 2 (CVE-2017-5715). Until Intel releases stable microcode or RedHat switches to ‘retpoline’, no mitigation for Spectre Variant 2 (CVE-2017-5715) is safely usable.
It is currently possible to mitigate Meltdown (CVE-2017-5754) and Spectre Variant 1 (CVE-2017-5753) by:
Centos is following RedHat (see above).
It is currently possible to mitigate Meltdown (CVE-2017-5754) and Spectre Variant 1 (CVE-2017-5753) by:
Scientific Linux is following RedHat (see above).
It is currently possible to mitigate Meltdown (CVE-2017-5754) and Spectre Variant 1 (CVE-2017-5753) by:
Additional details as well as information on other systems and platforms can be found in the next section.
CERN has compiled information which is useful for many EGI sites:
Intel has initially, on January 8th, released new microcodes to complement the IBRS kernel patchset. However, these new microcodes are in fact unstable and Intel has since then recommended to stop deploying them.
Intel latest recommendation can be found in their advisory, INTEL-SA-00088
More updates and information:
Important! [as of 17th January]
RedHat has issued new microcode_ctl packages to rollback the latest updates, see RHSA-2018:0093.
RedHat description:
RedHat CVE info:
Important! [as of 17th January]
Centos seems to be following Redhat in the revert of the microcode_ctl package, see the disclaimer in the sources of the last package
CentOS 7:
CentOS 6:
See further in the centos-announce Security mails for January
Important! [as of 18th January]
Scientific Linux is following RedHat in the revert of the microcode_ctl package, see SLSA 2018:0093-1
SL7: SLASA 2018:0007-1
Important! [as of 23rd January]
Dell is advising that all customers and partners should not deploy the BIOS update for the Spectre vulnerability at this time due to Intel’s advisory acknowledging reboot issues and unpredictable system behaviour.
DELL: support for meltdown and spectre
DELL: side channel vulnerabilities
Note this is changing rather frequently
[as of January 23]
HPE has updated their advisory to note that “Marked impacted products with TBD for System ROM updates per Intel’s guidance on microcode issues” - so following suit with DELL.
[as of January 23]
Lenovo security advisory
In order to protect hypervisors from malicious VMs, the kernel, microcode and QEMU must be updated: