Gilou's latest activity
-
GGilou reacted to Johannes S's post in the thread [SOLVED] Are there mitigations available for CVE-2026-53359 'Januscape' with
Like.
The nested flags of containers has nothing to do with nested virtualization. It's if you want to run containers inside of containers (e.g. podman or docker inside lxc ( which is NOT recommended) or lxcs inside lxcs (this should work usually)) or... -
GGilou replied to the thread [SOLVED] Are there mitigations available for CVE-2026-53359 'Januscape'.it is on by default, per the kernel module settings, but it's not required at all. You only need it to emulate an hypervisor as a VM, so that qemu can itself use KVM and the virtualization extension of the CPU. It's not even available to a VM by...
-
GGilou reacted to fabian's post in the thread [SOLVED] Are there mitigations available for CVE-2026-53359 'Januscape' with Like.
fixed kernels are now on pve-no-subscription
-
GGilou replied to the thread [SOLVED] Are there mitigations available for CVE-2026-53359 'Januscape'.it will reach the enterprise / pve-no-sub repositories shortly, I'm sure, but getting bits from pvetest is not exactly recommended. You could use pinning to only bring a specific package from that repository (and ignore the rest, or opt-in for...
-
GGilou reacted to fabian's post in the thread [SOLVED] Are there mitigations available for CVE-2026-53359 'Januscape' with Like.
fixed 6.8 and 7.0 kernels are on pve-test (proxmox-kernel-6.8.12-33-pve, proxmox-kernel-7.0.14-4-pve), 6.17 will follow shortly.
-
GGilou replied to the thread [SOLVED] Are there mitigations available for CVE-2026-53359 'Januscape'.Also, the PoC published doesn't manage to race on an AMD CPU, host running 7.0.14-3-pve. Do not run it on a production system...
-
GGilou replied to the thread [SOLVED] Are there mitigations available for CVE-2026-53359 'Januscape'.Mitigation on hosts not relying on nested virtualization is to indeed disable nested KVM through: options kvm-intel nested=N options kvm-amd nested=0 in /etc/modprobe.d/nested-kvm.conf