Hi all
I am a few confused with the new vulnerabilities and want to create a POST to obtain some help from more
experimented profesional and hope that this post can also help to more proxmox novice user as it's my case.
I understand that there is 2 vulnerabilities, Meltdown and spectre, with 2 variants for one of them (spectre). The most easy to exploit is meltdown, and seem also the most easy to mitige, by updating kernel in guest (centos in our case) and host (proxmox server), this also solve one of the 2 variants of spectre (CVE-2017-5753), but not the other one (CVE-2017-5715).
For the last one, (CVE-2017-5715), it's needed to update bios server or dirctly update micocode intel?
I have seen the microcode of E5-2650 in our case, the readme say :
To update the microcode.dat to the system, one need:
1. Ensure the existence of /dev/cpu/microcode
2. Write microcode.dat to the file, e.g.
dd if=microcode.dat of=/dev/cpu/microcode bs=1M
intel-ucode dirctory contains binary microcode files named in
family-model-stepping pattern. The file is supported in most modern Linux
distributions. It's generally located in the /lib/firmware directory,
and can be updated throught the microcode reload interface.
To update the intel-ucode package to the system, one need:
1. Ensure the existence of /sys/devices/system/cpu/microcode/reload
2. Copy intel-ucode directory to /lib/firmware, overwrite the files in
/lib/firmware/intel-ucode/
3. Write the reload interface to 1 to reload the microcode files, e.g.
echo 1 > /sys/devices/system/cpu/microcode/reload
We had to do this only on proxmox HOST or also in each VM? suppose that needs to reboot all then apply this? Is this what will impact performance (read about 5 to 30%)? We had to change something in the cpu definition of each GUEST?
Thanks for your help, I will try to update this post with answer
I am a few confused with the new vulnerabilities and want to create a POST to obtain some help from more
experimented profesional and hope that this post can also help to more proxmox novice user as it's my case.
I understand that there is 2 vulnerabilities, Meltdown and spectre, with 2 variants for one of them (spectre). The most easy to exploit is meltdown, and seem also the most easy to mitige, by updating kernel in guest (centos in our case) and host (proxmox server), this also solve one of the 2 variants of spectre (CVE-2017-5753), but not the other one (CVE-2017-5715).
For the last one, (CVE-2017-5715), it's needed to update bios server or dirctly update micocode intel?
I have seen the microcode of E5-2650 in our case, the readme say :
To update the microcode.dat to the system, one need:
1. Ensure the existence of /dev/cpu/microcode
2. Write microcode.dat to the file, e.g.
dd if=microcode.dat of=/dev/cpu/microcode bs=1M
intel-ucode dirctory contains binary microcode files named in
family-model-stepping pattern. The file is supported in most modern Linux
distributions. It's generally located in the /lib/firmware directory,
and can be updated throught the microcode reload interface.
To update the intel-ucode package to the system, one need:
1. Ensure the existence of /sys/devices/system/cpu/microcode/reload
2. Copy intel-ucode directory to /lib/firmware, overwrite the files in
/lib/firmware/intel-ucode/
3. Write the reload interface to 1 to reload the microcode files, e.g.
echo 1 > /sys/devices/system/cpu/microcode/reload
We had to do this only on proxmox HOST or also in each VM? suppose that needs to reboot all then apply this? Is this what will impact performance (read about 5 to 30%)? We had to change something in the cpu definition of each GUEST?
Thanks for your help, I will try to update this post with answer
