Hi Sebastian, thanks for your reply! Actually I have only one VM running. This has KVM64 as CPU (default) configuration. PCID is not set. The VM hosts a UCS system which has already updated their part of Linux against Meltdown.
Meltdown and Spectre Linux Kernel fixes
- Thread starter martin
- Start date
Hi Sebastian, thanks for your reply! Actually I have only one VM running. This has KVM64 as CPU (default) configuration. PCID is not set. The VM hosts a UCS system which has already updated their part of Linux against Meltdown.
If the kernel for your UCS system has backported PCID support, then it might have less of a performance impact with PCID on in proxmox.
yes.
And you need a recent kernel in your vm too (>=4.14), to have the benefit of PCID
or one which has the backport, which should be all or most of the Linux distro kernels which were updated to support KPTI/KAISER.
You can check your server with that : <edit> I can't post external link...</edit>
It's called specte-meltdown-checker on github..
At the moment with the last kernel on Proxmox 5 (4.13.13-5) we are protected against spectre variant 1 and meltdown...
But spectre variant 2 is still open.
It's called specte-meltdown-checker on github..
At the moment with the last kernel on Proxmox 5 (4.13.13-5) we are protected against spectre variant 1 and meltdown...
But spectre variant 2 is still open.
Attachments
You missed to install bios updates on your mainboard and/or install latest Intel Microcode updates (get them from https://packages.debian.org/buster/intel-microcode)
not a good idea, because every other HOST user space code that might get exploited by an attacker or run by an otherwise unprivileged user can still dump the whole memory without KPTI.
Dear Fabian,
Can you explain me more? Because I don't use proxmox server for anything than virtualization & nobody(except me) can't login into server.
And another question is can privileged LXC containers also can dump whole proxmox server memory?
Thanks
First... It is never advisable to have known security issues not addressed. Although physically you might be the only one having access, not fixing those issues will leave an open door to malicious software you might install knowing or unknowingly from bad sources. So not securing the server might still be a bad idea. Except your Proxmox isn't even connected to the internet in some way but I doubt that.
Second... Well, my understanding is, that for LXC containers it is even more problematic to not fix the problem as they share the hosts kernel afaik. So if the host is vulnerable to Meltdown and Spectre attacks, so will be your LXC containers. Due to the nature of sharing the same kernel with the host, LXC containers are all but isolated.
So basically I applied the latest kernel updates for promox 4.4 on 2 nodes, and it was a complete mess....
Having only windows kvm instances, have tried only “host” without PCID, have also tried “kvm64” with PCID, it was of no use.
Some machines running windows server 2012 r2 either fail to run and give BSOD, either they start and it disconnects/crashes all the time.
If anyone has some suggestions or advices, I would appreciate it.
Having only windows kvm instances, have tried only “host” without PCID, have also tried “kvm64” with PCID, it was of no use.
Some machines running windows server 2012 r2 either fail to run and give BSOD, either they start and it disconnects/crashes all the time.
If anyone has some suggestions or advices, I would appreciate it.
Are your windows machines up-to-date? Maybe you are missing a patch?
https://support.microsoft.com/en-us...your-windows-devices-against-spectre-meltdown
I wouldn't jump into the Spectre, microcode patch. Intel are saying it's buggy and caused reboots.
https://newsroom.intel.com/news/roo...-updated-guidance-for-customers-and-partners/
https://newsroom.intel.com/news/roo...-updated-guidance-for-customers-and-partners/