CloudLinux 7 and CloudLinux 6 Hybrid kernel v.1.5-38 has been scheduled for gradual rollout

CloudLinux 7 and CloudLinux 6 Hybrid kernel version 3.10.0-962.3.2.lve1.5.38 has been scheduled for gradual rollout from our production repository.

Rollout slot: 3

Rolled out to: 0.4%

ETA for 100% rollout: July, 8th

SRBDS System Information

The Linux kernel provides vulnerability status information through sysfs. For SRBDS this can be accessed by the following sysfs file: /sys/devices/system/cpu/vulnerabilities/srbds

The possible values contained in this file are:

Mitigation Mechanism

Intel will release microcode updates that modify the RDRAND, RDSEED, and EGETKEY instructions to overwrite secret special register data in the shared staging buffer before the secret data can be accessed by another logical processor.

Changelog

• CLKRN-597: ext4: wait for existing dio workers in ext4_alloc_file_blocks()
• CLKRN-597: ext4: check for directory entries too close to block end
• CLKRN-597: tcp: fix “old stuff” D-SACK causing SACK to be treated as D-SACK
• CLKRN-597: vfs: fix do_last() regression
• CLKRN-597: do_last(): fetch directory ->i_mode and ->i_uid before it’s too late
• CLKRN-597: CVE-2000-1134: CVE-2007-3852: CVE-2008-0525: CVE-2009-0416: CVE-2011-4834: CVE-2015-1838: CVE-2015-7442: CVE-2016-7489: namei: allow restricted O_CREAT of FIFOs and regular files
• CLKRN-601: make CONFIG_CL_* entries visible in “menuconfig”
• CLKRN-597: mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
• CLKRN-597: jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info when load journal
• CLKRN-597: x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
• CLKRN-597: PCI: Don’t disable bridge BARs when assigning bus resources
• CLKRN-597: scsi: qla2xxx: Fix mtcp dump collection failure
• CLKRN-597: CVE-2020-12114: fs/namespace.c: fix mountpoint reference counter race
• CLKRN-597: tracing: Fix tracing_stat return values in error handling paths
• CLKRN-597: tracing: Fix very unlikely race of registering two stat tracers
• CLKRN-597: ext4, jbd2: ensure panic when aborting with zero errno
• CLKRN-597: jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record
• CLKRN-597: KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c
• CLKRN-597: KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
• CLKRN-597: KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
• CLKRN-597: KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks
• CLKRN-597: tcp: clear tp->total_retrans in tcp_disconnect()
• CLKRN-597: mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
• CLKRN-597: net_sched: ematch: reject invalid TCF_EM_SIMPLE
• CLKRN-607: random: always use batched entropy for get_random_u{32,64}
• CLKRN-607: x86/speculation: Add Ivy Bridge to affected list

Update

For CloudLinux 7, run the command:

yum install kernel-3.10.0-962.3.2.lve1.5.38.el7

For CloudLinux 6 Hybrid, run the command:

yum install kernel-3.10.0-962.3.2.lve1.5.38.el6h

Immediate update (via bypass)

For CloudLinux 7, run the command:

yum install kernel-3.10.0-962.3.2.lve1.5.38.el7 --enablerepo=cloudlinux-rollout-3-bypass

For CloudLinux 6 Hybrid, run the command:

yum install kernel-3.10.0-962.3.2.lve1.5.38.el6h --enablerepo=cloudlinux-rollout-3-bypass