XCP-ng
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    XCP-ng 8.2 updates announcements and testing

    Scheduled Pinned Locked Moved News
    712 Posts 67 Posters 1.3m Views 84 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A Offline
      Andrew Top contributor @stormi
      last edited by

      @stormi Updates ran fine. Systems seem to be working.

      1 Reply Last reply Reply Quote 2
      • theAeonT Offline
        theAeon @stormi
        last edited by

        just joining the crowd of "seems fine"

        1 Reply Last reply Reply Quote 2
        • stormiS Offline
          stormi Vates 🪐 XCP-ng Team
          last edited by

          Thank you everyone.

          The update is published: https://xcp-ng.org/blog/2022/04/11/april-2022-security-update/

          1 Reply Last reply Reply Quote 1
          • gduperreyG Offline
            gduperrey Vates 🪐 XCP-ng Team
            last edited by gduperrey

            New updates (xen, Intel & AMD microcode)

            • Update the Intel microcode for the "IPU 2022.1" vulnerability (and other vulnerabilities and bugs)
              • "A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability."
              • See https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html
            • Update AMD microcode for Fam17h and Fam19h
            • Citrix also released an update for Xen. As we had already anticipated the patches they added (that fixed regressions introduced by the fixes to the XSA-400 vulnerabilities), it does not change anything for XCP-ng. We synced our RPM with theirs anyway to make future updates easier.

            Citrix' hotfix: https://support.citrix.com/article/CTX459703

            Test on XCP-ng 8.2

            From an up to date host:

            yum clean metadata --enablerepo=xcp-ng-testing
            yum update microcode_ctl linux-firmware "xen-*" --enablerepo=xcp-ng-testing
            reboot
            

            Versions:

            • xen-*: 4.13.4-9.22.1.xcpng8.2
            • microcode_ctl: 2:2.1-26.xs21.xcpng8.2
            • linux-firmware: 20190314-4.xcpng8.2

            What to test

            Normal use and anything else you want to test. The closer to your actual use of XCP-ng, the better.

            Test window before official release of the updates

            ~3 days.

            A R theAeonT gskgerG 4 Replies Last reply Reply Quote 1
            • A Offline
              Andrew Top contributor @gduperrey
              last edited by

              @gduperrey It's working for me, but my CPUs are not covered by the update. Normal operations seem normal.

              1 Reply Last reply Reply Quote 2
              • R Offline
                ravenet @gduperrey
                last edited by

                @gduperrey Seems fine here as well under basic usage.

                1 Reply Last reply Reply Quote 2
                • theAeonT Offline
                  theAeon @gduperrey
                  last edited by theAeon

                  @gduperrey Skylake-S Xeon here w/o patched bios, works fine so far.

                  edit: double checked /proc/cpuinfo, seems the ucode update is applying correctly, so, yeah, it worked.

                  1 Reply Last reply Reply Quote 2
                  • olivierlambertO Offline
                    olivierlambert Vates 🪐 Co-Founder CEO
                    last edited by

                    Tested on my EPYC test bench (so not really relevant), but at least nothing broke 🙂

                    1 Reply Last reply Reply Quote 2
                    • gskgerG Offline
                      gskger Top contributor @gduperrey
                      last edited by gskger

                      @gduperrey Updated my two host playlab (Dell Optiplex 9010, Intel i5-3550 CPU). Everything works as expected, but I doubt my CPUs are relevant for the update either.

                      I have a strange INTERNAL_ERROR((Failure "Expected string, got 'N'")) error with Xen Orchestra (from 3rd party script update to commit a1bcd) when creating a new Debian 11 VM as part of my test procedure, but I could continue with XCP-ng Center. Just found and will follow xoce INTERNAL_ERROR while trying to create VM.

                      1 Reply Last reply Reply Quote 2
                      • olivierlambertO Offline
                        olivierlambert Vates 🪐 Co-Founder CEO
                        last edited by

                        Yes, it's likely unrelated 🙂 Thanks for the report @gskger !

                        1 Reply Last reply Reply Quote 0
                        • gduperreyG Offline
                          gduperrey Vates 🪐 XCP-ng Team
                          last edited by

                          Update released. Thanks everyone for testing!

                          https://xcp-ng.org/blog/2022/05/16/may-2022-security-update/

                          1 Reply Last reply Reply Quote 3
                          • stormiS Offline
                            stormi Vates 🪐 XCP-ng Team
                            last edited by

                            New update candidate: uefistored

                            As microsoft.com recently blocked the user agent our secureboot-certs script uses to download UEFI Secure Boot certificates from them, we took the following actions:

                            • Documented how to download and install the certificates manually: https://xcp-ng.org/docs/guides.html#install-the-default-uefi-certificates-manually
                            • Changed the user agent in secureboot-certs to make the automated download and installation possible again.
                            • Added a new --user-agent parameter to secureboot-certs install to let you override the default easily in case of future need.
                            • Improved the error message in case of download failure to 1. let users know about the --user-agent parameter and 2. provide the link towards the manual installation instructions.

                            Test on XCP-ng 8.2

                            From an up to date host:

                            yum clean metadata --enablerepo=xcp-ng-testing
                            yum update uefistored --enablerepo=xcp-ng-testing
                            

                            No toolstack restart or reboot needed.

                            Versions:

                            • uefistored: 1.1.5-1.xcpng8.2.x86_64

                            What to test

                            UEFI VMs. Secure Boot. Installation of certificates using secureboot-certs install: manual install, automated install with default user agent, automated install with --user-agent parameter.

                            Test window before official release of the updates

                            ~ 1 week. Maybe more if it allows to synchronise with other updates not too far in the future.

                            A 1 Reply Last reply Reply Quote 2
                            • A Offline
                              Andrew Top contributor @stormi
                              last edited by

                              @stormi It installs and runs....

                              The "help" does not mention the user-agent option.

                              stormiS 1 Reply Last reply Reply Quote 1
                              • stormiS Offline
                                stormi Vates 🪐 XCP-ng Team @Andrew
                                last edited by

                                @Andrew That's because install is a sub-command: secureboot-certs install -h.

                                Anyway, if download fails (you can test by using "test" as the user agent for example), the option will be mentioned.

                                1 Reply Last reply Reply Quote 0
                                • stormiS Offline
                                  stormi Vates 🪐 XCP-ng Team
                                  last edited by

                                  To me, this uefistored update is ready, but I'll group it with the next updates.

                                  Test feedback remains welcome.

                                  1 Reply Last reply Reply Quote 0
                                  • stormiS Offline
                                    stormi Vates 🪐 XCP-ng Team
                                    last edited by stormi

                                    New security update (xen)

                                    Impact: when the conditions are met (roughly: CPU Model, PV guest + PCI passthrough or race condition exploitation), an attacker in a malicious VM may escalate privilege and control the whole host.

                                    Upstream (Xen project) references: XSA-401 and XSA-402

                                    Test on XCP-ng 8.2

                                    From an up to date host:

                                    yum clean metadata --enablerepo=xcp-ng-testing
                                    yum update xen-dom0-libs xen-dom0-tools xen-hypervisor xen-libs xen-tools --enablerepo=xcp-ng-testing
                                    reboot
                                    

                                    Versions:

                                    • xen-*: 4.13.4-9.22.2.xcpng8.2

                                    What to test

                                    Normal use and anything else you want to test. The closer to your actual use of XCP-ng, the better.

                                    Test window before official release of the updates

                                    ~2 days.

                                    gskgerG A 2 Replies Last reply Reply Quote 0
                                    • gskgerG Offline
                                      gskger Top contributor @stormi
                                      last edited by

                                      @stormi Update worked fine and no problems so far. Did the usual tests to create, move, snapshot, backup and restored some Linux and Windows VMs.

                                      1 Reply Last reply Reply Quote 1
                                      • A Offline
                                        Andrew Top contributor @stormi
                                        last edited by

                                        @stormi I've had it running for 24 hours on several active machines doing the usual jobs. Seems good.

                                        1 Reply Last reply Reply Quote 1
                                        • olivierlambertO Offline
                                          olivierlambert Vates 🪐 Co-Founder CEO
                                          last edited by

                                          Same here 🙂

                                          1 Reply Last reply Reply Quote 1
                                          • stormiS Offline
                                            stormi Vates 🪐 XCP-ng Team
                                            last edited by

                                            Update released (xen + uefistored). Thanks for your tests!

                                            Blog: https://xcp-ng.org/blog/2022/06/13/june-security-update-1/

                                            1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post