Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
spectre_and_meltdown_fixes_-_release_dates_for_linux_distros [08.01.2018 15:16] – Pascal Suter | spectre_and_meltdown_fixes_-_release_dates_for_linux_distros [24.01.2018 18:19] – [Spectre and Meltdown fixes] Pascal Suter | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ====== | + | ====== |
- | Unfortunately the [[https://meltdownattack.com|Meltdown | + | This page should give you a short overview of what is currently available to update your Intel based server or Workstation to get as good as possible patched against Spectre ( CVE 2017-5753 (Bounds Check Bypass |
+ | |||
+ | ===== What' | ||
+ | **this update will need a reboot of your server | ||
+ | |||
+ | in general you need to update your kernel to the latest versions provided | ||
+ | |||
+ | Here is how it' | ||
apt-get update && apt-get upgrade | apt-get update && apt-get upgrade | ||
- | in ubuntu and | + | ... in ubuntu and .. |
yum update | yum update | ||
- | in RedHat and CentOS distributions. | + | .. in RedHat and CentOS distributions. |
- | **this update | + | this will protect you against Variant 1 and Variant 3 vlunerabilities. In order to also protect against Variant 2, you further need to update |
- | However, now that the news is out, every OS vendor tries to be as fast as possible in pushing out patches, so possibly fixes will be released earlier. | + | ===== Different Distributions and their update status ===== |
- | here is a list of links with information about updates available from linux distributions | + | here is a list of links with information about updates available from linux distributions |
* [[https:// | * [[https:// | ||
- | * [[https:// | + | * [[https:// |
* [[https:// | * [[https:// | ||
* [[https:// | * [[https:// | ||
Line 19: | Line 26: | ||
for further information read those pages or check out the [[https:// | for further information read those pages or check out the [[https:// | ||
+ | ===== Microcode Update - Yes it's necessary too! ===== | ||
+ | Update 22.1.2017: ** [[https:// | ||
+ | |||
+ | After you have installed the latest OS updates, your system should be protected against Variant 1 and 3, in order to protect against Variant 2, you also need to install a newer microcode (firmware of the CPU). | ||
+ | Usually the microcode package is also a package in your distributions repository and is updated during a normal os upgrade. However, there where some [[https:// | ||
+ | |||
+ | So now you have two options: 1.) wait until a stable microcode update is available and stay vulnerable until then or 2.) install the currently available microcode update and risk having a less stable system. I have to mention, that intel says that only "some configurations" | ||
+ | |||
+ | Here is, how you can download the microcode package (for all intel processors) and then insert this into your Linux installation for Linux to load the latest microcode. | ||
+ | |||
+ | The latest officially released Microcodes can be found on the intel downloadcenter page. currently [[https:// | ||
+ | |||
+ | **NOTE: see update above: Intel discurages the use of these microcodes as it seems that they can cause your system to be unstable. Intel in fact changed their recommendations as of Jan. 22 from "ask your vendor to get the latest microcote" | ||
+ | |||
+ | < | ||
+ | |||
+ | - download the package of your choice to your System: < | ||
+ | cd / | ||
+ | wget <url> | ||
+ | </ | ||
+ | - now move your existing microcode package to another location, so you can move it back in case you have these stability issues that some users had with the new ones. then unpack and load the new microcode: < | ||
+ | cd / | ||
+ | mv intel-ucode / | ||
+ | tar xvf / | ||
+ | echo 1 > / | ||
+ | </ | ||
+ | you can double check if your microcode was loaded using < | ||
+ | you should now be up to date with the latest patches for all three Variants of the Spectre & Meltdown vulnerability. | ||
+ | |||
+ | ==== Understanding the release notes ==== | ||
+ | Intel' | ||
+ | -- Updates upon 20171117 release -- | ||
+ | IVT C0 (06-3e-04: | ||
+ | SKL-U/Y D0 (06-4e-03: | ||
+ | BDW-U/Y E/ | ||
+ | HSW-ULT Cx/ | ||
+ | Crystalwell Cx (06-46-01: | ||
+ | BDW-H E/ | ||
+ | HSX-EX E0 (06-3f-04: | ||
+ | SKL-H/S R0 (06-5e-03: | ||
+ | HSW Cx/ | ||
+ | HSX C0 (06-3f-02: | ||
+ | BDX-DE V0/ | ||
+ | BDX-DE V2 (06-56-03: | ||
+ | KBL-U/Y H0 (06-8e-09: | ||
+ | KBL Y0 / CFL D0 (06-8e-0a: | ||
+ | KBL-H/S B0 (06-9e-09: | ||
+ | CFL U0 (06-9e-0a: | ||
+ | CFL B0 (06-9e-0b: | ||
+ | SKX H0 (06-55-04: | ||
+ | GLK B0 (06-7a-01: | ||
+ | </ | ||
+ | * '' | ||
+ | * '' | ||
+ | * '' | ||
+ | * '' | ||
+ | grep -P "^(cpu family)|(model\s*: | ||
+ | </ | ||
+ | * the last part '' | ||
+ | * by the way, '' | ||
+ | ===== Minimalistic Fix on CentOS 7.4 ===== | ||
+ | Should you, for some reason, not be able or willing to run a full update, I have here a minimalistic fix for your centos: | ||
+ | |||
+ | - download the necessary update packages < | ||
+ | mkdir -p / | ||
+ | cd / | ||
+ | for p in kernel-abi-whitelists-3.10.0-693.11.6.el7.noarch.rpm kernel-debug-3.10.0-693.11.6.el7.x86_64.rpm kernel-debug-devel-3.10.0-693.11.6.el7.x86_64.rpm kernel-devel-3.10.0-693.11.6.el7.x86_64.rpm kernel-doc-3.10.0-693.11.6.el7.noarch.rpm kernel-headers-3.10.0-693.11.6.el7.x86_64.rpm kernel-tools-3.10.0-693.11.6.el7.x86_64.rpm kernel-tools-libs-3.10.0-693.11.6.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-693.11.6.el7.x86_64.rpm perf-3.10.0-693.11.6.el7.x86_64.rpm python-perf-3.10.0-693.11.6.el7.x86_64.rpm kernel-3.10.0-693.11.6.el7.src.rpm kernel-3.10.0-693.11.6.el7.x86_64.rpm; | ||
+ | </ | ||
+ | - create a repository: < | ||
+ | - add your repository to yum < | ||
+ | |||
+ | cat > / | ||
+ | # CentOS-meltdown.repo | ||
+ | # | ||
+ | # contains minimalistic update to fix meltdown and spectre | ||
+ | [meltdown-updates] | ||
+ | name=CentOS-$releasever - Meltdown-Updates | ||
+ | baseurl=file:// | ||
+ | gpgcheck=0 | ||
+ | enabled=1 | ||
+ | EOF | ||
+ | </ | ||
+ | - run the update and reboot the machine: < | ||
+ | yum update | ||
+ | |||
+ | reboot | ||
+ | </ | ||
+ | |||
+ | ===== Test-Tools ===== | ||
+ | * [[https:// | ||
===== Performance Impact ===== | ===== Performance Impact ===== | ||
- | the fix for all this works in a way that it may affect the system performance negatively. Different sources claim different results reaching from no impact at all up to a 30% slowdown. As always, Benchmarks are probably not too representative for your realworld experience. In order to find out what the difference in performance is, you can simply disable the workaround on a patched kernel to run your workload once with and once without the patch. the workaround | + | the fix for all this works in a way that it may affect the system performance negatively. Different sources claim different results reaching from no impact at all up to a 30% slowdown. As always, Benchmarks are probably not too representative for your realworld experience. In order to find out what the difference in performance is, you can simply disable the workaround on a patched kernel to run your workload once with and once without the patch. |
+ | |||
+ | In CentOS (and probably other linux distributions as well) the workarounds | ||
+ | < | ||
+ | echo 0 > / | ||
+ | echo 0 > / | ||
+ | echo 0 > / | ||
+ | </ | ||
+ | by default all three fixes are enabled, if you want to disable them permanently (=on every boot) you can add these three options to your kernel command line: | ||
+ | < | ||
+ | noibrs noibpb nopti | ||
+ | </ |