Updates announcements and testing

bleader

Update published https://xcp-ng.org/blog/2024/08/16/august-security-update/

Thank you all for testing

manilx

@bleader All pools updated via RPU without issues.

bleader

New security update candidates (xen, microcode_ctl)

A new XSA was published on September 24th 2024.
Intel published a microcode update on the September 10th 2024.
We also included an updated xcp-ng-release for testing, althrough not related to security.

XSA-462 a malicious HVM or PVH guest can trigger a DoS of the host.

SECURITY UPDATES

xen-*:
* Fix XSA-462 - x86: Deadlock in vlapic_error(). The handling of x86's APIC (Advanced Programmable Interrupt Controller) allows a guest to configure an illegal vector to handle error interrupts. This causes the vlapic_error() to recurse, this is protected, but the lock used for this protection will try to be taken recursiveley, leading to a deadlock.
microcode_ctl:
    * Latest Intel microcode update, still named IPU 2024.3, including security updates for:
        * INTEL-SA-01103
        * INTEL-SA-01097

Other updates

xcp-ng-release:
    * Update the "XOA Quick deploy" feature in the host's web page.
    * Point at repo.vates.tech for CentOS since mirrorlist.centos.org was cut
    * Add "(EOL)" to repo descriptions for EOL repos
    * Drop unused repos

Test on XCP-ng 8.2

yum clean metadata --enablerepo=xcp-ng-candidates
yum update "xen-*" microcode_ctl xcp-ng-release --enablerepo=xcp-ng-candidates
reboot

The usual update rules apply: pool coordinator first, etc.

Versions:

xen: 4.13.5-9.44.1.xcpng8.2
microcode_ctl: microcode_ctl-2.1-26.xs29.5.xcpng8.2
xcp-ng-release: xcp-ng-release-8.2.1-13

What to test

Normal use and anything else you want to test.

Test window before official release of the update

~ 1 day because of security updates.

gskger

@bleader Update worked well on my two node homelab and everything looks and works normal after reboot. I did some basic stuff like VM and Storage migration, but nothing in depth. Let's see how things work out.

Andrew

@bleader I installed it on many 8.2 machines. On one I did get a warning:

  Cleanup    : xen-libs-4.13.5-9.40.3.xcpng8.2.x86_64                     14/14
warning: %posttrans(microcode_ctl-2:2.1-26.xs29.5.xcpng8.2.x86_64) scriptlet failed, exit status 1
Non-fatal POSTTRANS scriptlet failure in rpm package 2:microcode_ctl-2.1-26.xs29.5.xcpng8.2.x86_64
  Verifying  : xcp-ng-release-8.2.1-13.x86_64                              1/14

But it did not seem to have any effect. Nothing extra in the yum.log

bleader

@Andrew If I understand correctly that is ran after regenerating the initrd, but to be sure, can you check the date of your /boot/initrd-4.19.0+1.img on this host?

stormi

Here's what the posttrans scriptlet exactly executes:

    dracut -f /boot/initrd-4.19.0+1.img 4.19.0+1 
    udevadm trigger --attr-nomatch=driver && udevadm settle -t 30

bleader

So if the initrd has been regenerated, it's likely the second part that fails, otherwise it is dracut, which is more of an issue.

Andrew

@bleader @stormi Microcode was updated and initrd was rebuilt correctly and the system rebooted with the updates, so I don't know what the error was. Running the commands manually produces no errors. Maybe the system was busy and it was the shorter 30 second settle timeout (vs. the default 120 seconds), at this time it returns quickly.

The warning was only on one system (out of 5 identical pool hosts) but caused no actual issues.

bleader

Update published: https://xcp-ng.org/blog/2024/09/27/september-2024-security-updates/

Thank you for the tests!