CloudLinux 7 and CloudLinux 6 Hybrid kernel version 3.10.0-962.3.2.lve1.5.25.8 with a fix for MDS vulnerability is now available for download from our production repository.
Changelog:
1.5.25.7
- CLKRN-446: backport 3.18 stable fixes to CloudLinux 7;
- CLKRN-417: enable KABI check;
- CLKRN-424: IOPS limits support for the noop IO scheduler;
- CLKRN-421: fixed ext4 RO remounts;
- CLKRN-450: xfs: avoid invalid null-pointer dereference;
- CLKRN-147: fixed ub0 beancounter file lock charge/uncharge balance.
1.5.25.8
- CLKRN-457: fix KABI breakage;
- CLKRN-458: x86 MDS mitigations:
- CVE-2018-12126 MSBDS Microarchitectural Store Buffer Data Sampling;
- CVE-2018-12130 MFBDS Microarchitectural Fill Buffer Data Sampling;
- CVE-2018-12127 MLPDS Microarchitectural Load Port Data Sampling;
- CVE-2019-11091 MDSUM Microarchitectural Data Sampling Uncacheable Memory.
To update a kernel, please use the following command.
CloudLinux 7:
yum upgrade microcode_ctl && yum install kernel-3.10.0-962.3.2.lve1.5.25.8.el7
CloudLinux 6 Hybrid:
yum upgrade microcode_ctl && yum install kernel-3.10.0-962.3.2.lve1.5.25.8.el6h
Mitigation: kernel with MDS patches + microcode + disable Hyper-Threading
In multi-tenant systems where the Host has Hyper-Threading disabled, different guests should not have access to threads on the same core and should not be vulnerable. Host performance and overall availability of resources will be impacted.
In multi-tenant systems where the Host has Hyper-Threading enabled and the hypervisor is vulnerable, guests will also be vulnerable if they have Hyper-Threading disabled or not.
In multi-tenant systems where the Host has Hyper-Threading enabled and the Hypervisor is not vulnerable, guests should consider disabling Hyper-Threading to protect themselves.
Diagnose your vulnerability
Apply the patches and perform vulnerability diagnostic by running one of the following commands:
# dmesg | grep “MDS:”
OR
# cat /sys/devices/system/cpu/vulnerabilities/mds
The possible values in this file are:
- Not affected – the processor is not vulnerable
- Vulnerable – the processor is vulnerable, but no mitigation enabled
- Vulnerable: Clear CPU buffers attempted – the processor is vulnerable but microcode is not updated; the mitigation is enabled on a best effort basis
- Mitigation: CPU buffer clear – the processor is vulnerable and the CPU buffer clearing mitigation is enabled
