ZombieLoad Attack Issues

This page includes the current information on released packages and templates, as well as recommendations related to dealing with the ZombieLoad vulnerabilities (RIDL ([MFBDS] CVE-2018-12130, [MLPDS] CVE-2018-12127, [MDSUM] CVE-2019-11091, and Fallout ([MSBDS] CVE-2018-12126). The page will be updated as soon as we have new information for you.

The ZombieLoad attack allows stealing sensitive data and keys while a computer accesses them. These issues have been observed on personal computers and in the cloud. While programs normally see only their own data, a malicious program can obtain information currently processed by other running programs. This can be such user data as browser history, website content, user keys, and passwords; or system data, such as disk encryption keys. For additional information, refer to ZombieLoad Attack.

Note that RHEL/CentOS 5 will not be addressed based on the severity of these issues, where Red Hat Enterprise Linux 5 is in its support lifecycle, and the low number of CPU types that will have available microcode that is required for these mitigations.
If you are still running CentOS 5, contact our support team to move to a supported release.

[Jun 27, 2019]

Update for all Virtuozzo OnApp versions which components support CentOS 7.x.

Red Hat (and centos.org as well) has released new kernel version 3.10.0-957.21.3.el7 (for RHEL/CentOS 7.x).

Depending on the resources that you run on your cloud, we recommend the following:

Virtuozzo OnApp customers’ boxes running CentOS 7.x: Control Panel(s), Static KVM Compute Resource(s), Static Backup Server(s) are recommended to upgrade the kernel.
OnApp’s System Packages Upgrade option (the installer ‘-y’ option) can be used for Control Panels and Static Backup Servers.
Static KVM Compute Resources kernel can be updated with the following command:
1
# yum update kernel

Update for all Virtuozzo OnApp versions which components support CentOS 6.x.

Red Hat (and centos.org as well) has released new kernel version 2.6.32-754.15.3.el6.x86_64 (for RHEL/CentOS 6.x).

Depending on the resources that you run on your cloud, we recommend the following:

Virtuozzo OnApp customers’ boxes running CentOS 6.x: Control Panel(s), Static KVM Compute Resource(s), Static Backup Server(s) are recommended to upgrade the kernel.
OnApp’s System Packages Upgrade option (the installer ‘-y’ option) can be used for Control Panels and Static Backup Servers.
Static KVM Compute Resources kernel can be updated with the following command:
1
# yum update kernel

[June 6, 2019]

Virtuozzo OnApp provides the following new packages for CloudBoot Xen Compute Resources:

CentOS 6.x

onapp-ramdisk-centos6-xen-6.0.0-32.noarch.rpm

CentOS 7.x

onapp-ramdisk-centos7-xen-6.0.0-32.noarch.rpm

[June 3, 2019]

CentOS 7.x

centos.org has released a new kernel version 4.9.177-35.el7.x86_64 and a new Xen version 4.10.3.38.g48bd9061a2-1.el7 (for RHEL/CentOS 7.x and Xen) to provide fixes for the security issue. Update Static CentOS 7 Xen compute resources to update these packages. The standard update procedure for Virtuozzo OnApp Static Compute Resource should be used.

CentOS 6.x

centos.org has released a new kernel version 4.9.177-35.el6.x86_64 and a new Xen version 4.8.5.21.g752fb21a29-1.el6 (for RHEL/CentOS 6.x and Xen) to provide fixes for the security issue. Update Static CentOS 6 Xen compute resources to update these packages. The standard update procedure for Virtuozzo OnApp Static Compute Resource should be used.

[May 29, 2019]

Virtuozzo OnApp provides the following new packages for CloudBoot KVM Compute Resources:

CentOS 6.x

onapp-ramdisk-centos6-kvm-6.0.0-30.noarch.rpm

CentOS 7.x

onapp-ramdisk-centos7-default-6.0.0-30.noarch.rpm
onapp-ramdisk-centos7-kvm-6.0.0-30.noarch.rpm

Virtuozzo OnApp provides the following virtual server basic templates to address security issues for CloudBoot KVM Compute Resources:

centos-6.10-x64-1.1-xen.kvm.kvm_virtio.tar.gz
centos-7.6-x64-1.4-xen.kvm.kvm_virtio.tar.gz
debian-8.11-x64-1.0-xen.kvm.kvm_virtio.tar.gz
debian-9.9-x64-1.0-xen.kvm.kvm_virtio.tar.gz
ubuntu-18.04-x64-1.3-xen.kvm.kvm_virtio.tar.gz
ubuntu-19.04-x64-1.0-xen.kvm.kvm_virtio.tar.gz
fedora-27-x64-1.1-xen.kvm.kvm_virtio.tar.gz
sles-15.0-x64-1.3-xen.kvm.kvm_virtio.tar.gz
sles-12.4-x64-1.1-xen.kvm.kvm_virtio.tar.gz
rhel-7.6-x64-1.2-xen.kvm.kvm_virtio.tar.gz
archlinux-2018.12-x64-1.3-xen.kvm.kvm_virtio.tar.gz
gentoo-2019.05-x64-1.0-xen.kvm.kvm_virtio.tar.gz

For more details on fixes, refer to Virtuozzo OnApp 6.0 CloudBoot Security Update.

[May 16, 2019]

Update for all Virtuozzo OnApp versions which components support CentOS 7.x

Red Hat (and centos.org as well) has released new kernel version 3.10.0-957.12.2.el7 (for RHEL/CentOS 7.x) with the following security fixes:

CVE-2018-12130
A flaw was found in the implementation of the “fill buffer”, a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer.
CVE-2018-12126
Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the ‘processor store buffer’. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU’s processor store buffer.
CVE-2018-12127
Microprocessors use a ’load port’ subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPU’s pipelines. Stale load operations results are stored in the ’load port’ table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
CVE-2019-11091
Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.

Depending on the resources that you run on your cloud, we recommend the following:

Virtuozzo OnApp customers’ boxes running CentOS 7.x: Control Panel(s), Static KVM Compute Resource(s), Static Backup Server(s) are recommended to upgrade the kernel.
OnApp’s System Packages Upgrade option (the installer ‘-y’ option) can be used for Control Panels and Static Backup Servers.
Static KVM Compute Resources kernel can be updated with the following command:
1
yum update kernel

Red Hat (and centos.org as well) has released QEMU KVM EV new version 32.12.0-18.el7_6.5 (for RHEL/CentOS 7.x) to provide fixes for the security issue.

Virtuozzo OnApp customers’ Static CentOS 7 KVM compute resources are recommended to update the qemu-kvm-ev packages.
The standard update procedure for Virtuozzo OnApp Static Compute Resource should be used.

Red Hat (and centos.org as well) has released libvirt new version 4.5.0-10.el7_6.9 (for RHEL/CentOS 7.x) to provide fixes for the security issue.

Virtuozzo OnApp customers’ Static CentOS 7 KVM compute resources are recommended to update the libvirt packages.
The standard update procedure for Virtuozzo OnApp Static Compute Resource should be used.

Red Hat (and centos.org as well) has released microcode_ctl new version 2.1-47.2.el7_6 (for RHEL/CentOS 7.x) to provide fixes for the security issue.

All boxes under CentOS 7.x are recommended to check (for CPU compatibility) and to update microcode_ctl.
More details and the upgrade instructions can be found at RHEA-2019:1210 - Product Enhancement Advisory.

All guests’ (VSs’) Operating Systems should be checked and if available updated with the most recent packages.

Update for all Virtuozzo OnApp versions which components support CentOS 6.x

Red Hat (and centos.org as well) has released new kernel version 2.6.32-754.14.2.el6 (for RHEL/CentOS 6.x) with the following security fixes:

CVE-2018-12130
CVE-2018-12126
CVE-2018-12127
CVE-2019-11091

Depending on the resources that you run on your cloud, we recommend the following:

Virtuozzo OnApp customers’ boxes running CentOS 6.x: Control Panel(s), Static KVM Compute Resource(s), Static Backup Server(s) are recommended to upgrade the kernel.
OnApp’s System Packages Upgrade option (the installer ‘-y’ option) can be used for Control Panels and Static Backup Servers.
Static KVM Compute Resources kernel can be updated with the following command:
1
yum update kernel

Red Hat (and centos.org as well) has released QEMU KVM EV new version 0.12.1.2-2.506.el6_10.3 (for RHEL/CentOS 6.x) to provide fixes for the security issue.

Virtuozzo OnApp customers’ Static CentOS 6 KVM compute resources are recommended to update the qemu-kvm-ev packages.
The standard update procedure for Virtuozzo OnApp Static Compute Resource should be used.

Red Hat (and centos.org as well) has released libvirt new version 0.10.2-64.el6_10.1 (for RHEL/CentOS 6.x) to provide fixes for the security issue.

Virtuozzo OnApp customers’ Static CentOS 6 KVM compute resources are recommended to update the libvirt packages.
The standard update procedure for Virtuozzo OnApp Static Compute Resource should be used.

Red Hat (and centos.org as well) has released microcode_ctl new version 1.17-33.11.el6_10 (for RHEL/CentOS 6.x) to provide fixes for the security issue.

All boxes under CentOS 6.x are recommended to check (for CPU compatibility) and to update microcode_ctl.
More details and the upgrade instructions can be found at RHEA-2019:1212 - Product Enhancement Advisory.