The update is published. Thanks for your tests!
Blog post: https://xcp-ng.org/blog/2022/11/04/november-2022-security-update/
gduperrey
@gduperrey
Stormi's helper.
Science-Fiction and Fantasy lover. Love books, comics, animes...
Best posts made by gduperrey
-
RE: Updates announcements and testing
-
RE: Updates announcements and testing
New security update candidates (xen)
Xen is being updated to mitigate some vulnerabilities:
- XSA-326: Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored.
- XSA-419: Xenstore: Cooperating guests can create arbitrary numbers of nodes
- XSA-414: A malicious guest can cause xenstored to crash, resulting in the inability to create new guests or to change the configuration of running guests.
- XSA-415: Xenstore: Guests can create orphaned Xenstore nodes
- XSA-416: Xenstore: Guests can cause Xenstore to not free temporary memory
- XSA-417: Xenstore: Guests can get access to Xenstore nodes of deleted domains
- XSA-418: Xenstore: Guests can crash xenstored via exhausting the stack
- XSA-420: Oxenstored 32->31 bit integer truncation issues. A malicious or buggy guest can write a packet into the xenstore ring which causes 32-bit builds of oxenstored to busy loop.
- XSA-421: Xenstore: Guests can create arbitrary number of nodes via transactions
Test on XCP-ng 8.2
From an up to date host:
yum clean metadata --enablerepo=xcp-ng-testing yum update xen-dom0-libs xen-dom0-tools xen-hypervisor xen-libs xen-tools --enablerepo=xcp-ng-testing reboot
Versions:
- xen-*: 4.13.4-9.27.1.xcpng8.2
What to test
Normal use and anything else you want to test. The closer to your actual use of XCP-ng, the better.
Test window before official release of the updates
~2 days.
-
RE: Updates announcements and testing
The update is published. Thanks for your tests!
Blog post: https://xcp-ng.org/blog/2022/10/14/october-2022-security-update/
-
RE: Updates announcements and testing
New security update candidates (xen, linux-firmware, edk2, xapi)
Xen and XAPI are being updated to mitigate some vulnerabilities:
- XSA-410: Two privileged users in two guest VMs, in collaboration, can crash the host or make it unresponsive.
- XSA-411: Correct a flaw in XSA-226 that allows DoS attacks from guest kernels to harm the whole system.
- XSA-413: The management service on the host can become unresponsive or crash by the means of an unauthenticated user on the management network.
In this release, there are also the following fixes and improvements:
-
XAPI, issues resolved:
- When you had an active VIF connected on dom0, you couldn't delete that VIF or the associated network, including VLAN.
- When certificates contain the \r character, the xe host-get-server-certificate command can incorrectly output it.
-
xen, linux-firmware, edk2:
- Issues resolved:
- Sometimes a VM freezes when a graphics-intensive application run
- Sometimes guest UEFI firmware hangs
- Improvements:
- AMD microcode is updated to version 2022-09-30
- Improvements to Xen diagnostics.
- Issues resolved:
Test on XCP-ng 8.2
From an up to date host:
yum clean metadata --enablerepo=xcp-ng-testing yum update edk2 linux-firmware xen-dom0-libs xen-dom0-tools xen-hypervisor xen-libs xen-tools forkexecd message-switch xapi-core xapi-tests xapi-xe xcp-rrdd xenopsd xenopsd-cli xenopsd-xc --enablerepo=xcp-ng-testing reboot
Versions:
- edk2-20180522git4b8552d-1.4.6.xcpng8.2
- linux-firmware-20190314-5.xcpng8.2
- xen-*: 4.13.4-9.26.1.xcpng8.2
- forkexecd-1.18.1-1.1.xcpng8.2
- message-switch-1.23.2-3.2.xcpng8.2
- xapi-*: 1.249.26-2.1.xcpng8.2
- xcp-rrdd-1.33.0-6.1.xcpng8.2
- xenopsd-*: 0.150.12-1.2.xcpng8.2
What to test
Normal use and anything else you want to test. The closer to your actual use of XCP-ng, the better.
Test window before official release of the updates
~2 days.
-
RE: Updates announcements and testing
The update is published. Thanks for your tests!
Blog post: https://xcp-ng.org/blog/2022/10/05/october-2022-maintenance-update/
-
RE: Updates announcements and testing
Update released. Thanks everyone for testing!
https://xcp-ng.org/blog/2022/05/16/may-2022-security-update/
-
RE: Updates announcements and testing
The updates have been published; thank you for testing them out.
https://xcp-ng.org/blog/2024/03/29/march-2024-maintenance-update/
-
RE: Updates announcements and testing
New update candidates for you to test!
As you may know, we group non-urgent updates together for a collective release, in order not to cause unnecessary maintenance for our users.
The moment to release such a batch has come, so here they are, ready for user tests before the final release.
openvswitch
:- CVE-2023-1668: Correct a flaw when processing an IP packet with protocol 0.
- CVE-2023-5366: Apply the patch for OpenFlow and neightbor discovery target with IPv6
- CVE-2023-3966: Correct a vulnerabity with "crafted Geneve packets causing invalid memory accesses and potential denial of service".
blktap
:- Synced with XS82ECU1056:
- Bugfix for time out on NFS tasks which can sometimes exceed the configured value.
- Improve the error handling for some lost iSCSI connection.
- Synced with XS82ECU1056:
sm
:- Support NFS servers which only offer NFSv4. The discovery process for such servers differs from that of servers which offer also NFSv3, so the SR driver had to be improved.
- Synced with XS82ECU1056: bugfix on the path checker for DELL EqualLogic with iSCSI protocol
- Synced with XS82ECU1060: bugfix for when a host is unable to log into all iSCSI portals because there are separate independent Target Portal Groups inside the IQN.
util-linux
: preparatory steps to support 4k-only disks.xapi
: Bugfix in a testing framework.xcp-ng-pv-tools
: Small fixes regarding VM stats reporting.xcp-ng-xapi-plugins
: Add check_installed function in updater plugin to test installed packages. This is a prerequisite for the upcoming XOSTOR release.
Test on XCP-ng 8.2
From an up to date host:
yum clean metadata --enablerepo=xcp-ng-testing yum update --enablerepo=xcp-ng-testing blktap openvswitch sm-* util-linux xapi-* xcp-ng-pv-tools xcp-ng-xapi-plugins reboot
The usual update rules apply: pool coordinator first, etc.
Versions
blktap
: 3.37.4-3.1.xcpng8.2openvswitch
: 2.5.3-2.3.12.2.xcpng8.2sm
: 2.30.8-10.1.xcpng8.2util-linux
: 2.23.2-52.1.xcpng8.2xapi
: 1.249.32-2.2.xcpng8.2xcp-ng-pv-tools
: 8.2.0-12.xcpng8.2xcp-ng-xapi-plugins
: 1.10.0-1.xcpng8.2
What to test
Normal use and anything else you want to test. The closer to your actual use of XCP-ng, the better.
Test window before official release of the updates
~1 week.
-
RE: XCP-ng 8.3 beta 🚀
A new version of xo-lite for XCP-ng 8.3 has been released:
Version:
xo-lite-0.2.0-1.xcpng8.3
You can update it like this:
yum update xo-lite
For more information about the changes between version 0.1.3 and 0.2.0, you can consult this link: https://github.com/vatesfr/xen-orchestra/blob/master/%40xen-orchestra/lite/CHANGELOG.md
-
RE: Updates announcements and testing
New Security Update Candidates (Xen)
Xen is being updated to mitigate some vulnerabilities:
- XSA-439: CVE-2023-20588. On AMD Zen1 CPUs, "an attacker might be able to infer data from a different execution context on the same CPU core."
Test on XCP-ng 8.2
From an up to date host:
yum clean metadata --enablerepo=xcp-ng-testing yum update "xen-*" --enablerepo=xcp-ng-testing reboot
Version:
- xen: 4.13.5-9.36.2.xcpng8.2
What to test
Normal use and anything else you want to test. The closer to your actual use of XCP-ng, the better.
Test window before official release of the updates
~2 days.
Latest posts made by gduperrey
-
RE: High Fan Speed Issue on Lenovo ThinkSystem Servers
You can find information about
kernel-alt
here: https://docs.xcp-ng.org/installation/hardware/#-alternate-kernel -
RE: XCP-ng 8.3 beta 🚀
A new version of xo-lite for XCP-ng 8.3 has been released:
Version:
xo-lite-0.2.1-1.xcpng8.3
You can update it like this:
yum update xo-lite
For more information about the changes between version 0.1.3 or 0.2.0 and 0.2.1, you can consult this link: https://github.com/vatesfr/xen-orchestra/blob/master/%40xen-orchestra/lite/CHANGELOG.md
-
RE: Updates announcements and testing
The updates have been published; thank you for testing them out.
https://xcp-ng.org/blog/2024/03/29/march-2024-maintenance-update/
-
RE: Updates announcements and testing
New update candidates for you to test!
As you may know, we group non-urgent updates together for a collective release, in order not to cause unnecessary maintenance for our users.
The moment to release such a batch has come, so here they are, ready for user tests before the final release.
openvswitch
:- CVE-2023-1668: Correct a flaw when processing an IP packet with protocol 0.
- CVE-2023-5366: Apply the patch for OpenFlow and neightbor discovery target with IPv6
- CVE-2023-3966: Correct a vulnerabity with "crafted Geneve packets causing invalid memory accesses and potential denial of service".
blktap
:- Synced with XS82ECU1056:
- Bugfix for time out on NFS tasks which can sometimes exceed the configured value.
- Improve the error handling for some lost iSCSI connection.
- Synced with XS82ECU1056:
sm
:- Support NFS servers which only offer NFSv4. The discovery process for such servers differs from that of servers which offer also NFSv3, so the SR driver had to be improved.
- Synced with XS82ECU1056: bugfix on the path checker for DELL EqualLogic with iSCSI protocol
- Synced with XS82ECU1060: bugfix for when a host is unable to log into all iSCSI portals because there are separate independent Target Portal Groups inside the IQN.
util-linux
: preparatory steps to support 4k-only disks.xapi
: Bugfix in a testing framework.xcp-ng-pv-tools
: Small fixes regarding VM stats reporting.xcp-ng-xapi-plugins
: Add check_installed function in updater plugin to test installed packages. This is a prerequisite for the upcoming XOSTOR release.
Test on XCP-ng 8.2
From an up to date host:
yum clean metadata --enablerepo=xcp-ng-testing yum update --enablerepo=xcp-ng-testing blktap openvswitch sm-* util-linux xapi-* xcp-ng-pv-tools xcp-ng-xapi-plugins reboot
The usual update rules apply: pool coordinator first, etc.
Versions
blktap
: 3.37.4-3.1.xcpng8.2openvswitch
: 2.5.3-2.3.12.2.xcpng8.2sm
: 2.30.8-10.1.xcpng8.2util-linux
: 2.23.2-52.1.xcpng8.2xapi
: 1.249.32-2.2.xcpng8.2xcp-ng-pv-tools
: 8.2.0-12.xcpng8.2xcp-ng-xapi-plugins
: 1.10.0-1.xcpng8.2
What to test
Normal use and anything else you want to test. The closer to your actual use of XCP-ng, the better.
Test window before official release of the updates
~1 week.
-
RE: XCP-ng 8.3 beta 🚀
A new version of xo-lite for XCP-ng 8.3 has been released:
Version:
xo-lite-0.2.0-1.xcpng8.3
You can update it like this:
yum update xo-lite
For more information about the changes between version 0.1.3 and 0.2.0, you can consult this link: https://github.com/vatesfr/xen-orchestra/blob/master/%40xen-orchestra/lite/CHANGELOG.md
-
RE: Error: Multilib version problems found. This often means that the root
@Ben said in Error: Multilib version problems found. This often means that the root:
Protected multilib versions: libcom_err-1.47.0-1.1.xcpng8.2.x86_64 != libcom_err-1.42.9-19.el7.i686
If I understand right from the log you posted, you installed another version of libcom_err than the one from XCP-ng. So you'll need to remove that one and have ours:
yum remove libcom_err-1.42.9-19.el7.i686 yum install libcom_err-1.47.0-1.1.xcpng8.2.x86_64
It would be better to disable the OMSA repo as suggested in our documentation about additional packages: https://xcp-ng.org/docs/additionalpackages.html#rules
-
RE: Updates announcements and testing
New Security Update Candidates (Xen)
Xen is being updated to mitigate some vulnerabilities:
- XSA-439: CVE-2023-20588. On AMD Zen1 CPUs, "an attacker might be able to infer data from a different execution context on the same CPU core."
Test on XCP-ng 8.2
From an up to date host:
yum clean metadata --enablerepo=xcp-ng-testing yum update "xen-*" --enablerepo=xcp-ng-testing reboot
Version:
- xen: 4.13.5-9.36.2.xcpng8.2
What to test
Normal use and anything else you want to test. The closer to your actual use of XCP-ng, the better.
Test window before official release of the updates
~2 days.
-
RE: Updates announcements and testing
Update published. Thanks for the tests!
https://xcp-ng.org/blog/2023/08/14/august-2023-security-update/
-
RE: Updates announcements and testing
New Security Update Candidates (kernel, Xen, linux-firmware, microcode_ctl, XAPI...)
Xen is being updated to mitigate some vulnerabilities:
-
XSA-432: CVE-2023-34319. Under Linux, a buffer overrun in netback can be triggered due to unusual packets. This behavior was due to the fix of the XSA-423 which didn't account an extreme case of an entire packet being split into as many pieces as permitted by the protocol and still being smaller than the area that's dealt with to keep all headers together. It is possible to crash a host from a vm, with malicious and privileged code.
-
XSA-434: CVE-2023-20569. Researchers from ETH Zurich have extended their prior research (XSA-422, Branch Type Confusion, a.k.a Retbleed) and have discovered INCEPTION, also known as RAS (Return Address Stack) Poisoning, and Speculative Return Stack Overflow. An attacker might be able to infer the contents of memory belonging to other guests.
-
XSA-435: CVE-2022-40982. A security issue in certain Intel CPUs may allow an attacker to infer data from different contexts on the same core.
Components are also updated to add bugfixes and enhancements:
-
guest-templates-json: Added Debian 12 Bookworm
-
XAPI:
- Several hotfixes and improvements from XS82ECU1033
- From XS82ECU1045 Significant performance improvements on a set of CPU features for servers with Cascade Lake or later Intel CPUs.
-
microcode_ctl: Update to IPU 2023.3
-
linux-firmware: Expose additional features for Intel CPUs, especially for Cascade Lake or later Intel CPUs. Updated to latest AMD firmware for processor family 19h.
-
Xen: Expose MSR_ARCH_CAPS to guests on all Intel hardware by default.
-
blktap, nbd: An update of the packages for Xostor.
Test on XCP-ng 8.2
From an up to date host:
yum clean metadata --enablerepo=xcp-ng-testing yum update "xen-*" microcode_ctl linux-firmware kernel forkexecd gpumon message-switch "ocaml-*" rrd2csv rrdd-plugins sm-cli squeezed varstored-guard vhd-tool wsproxy "xapi-*" xcp-networkd xcp-rrdd "xenopsd*" xs-opam-repo "guest-templates-*" blktap xcp-ng-linstor nbd tzdata grub* lldpad xcp-ng-xapi-plugins --enablerepo=xcp-ng-testing reboot
Version:
- forkexecd: 1.18.3-2.1.xcpng8.2
- gpumon: 0.18.0-10.1.xcpng8.2
- kernel: 4.19.19-7.0.17.1.xcpng8.2
- linux-firmware: 20190314-9.1.xcpng8.2
- message-switch: 1.23.2-9.1.xcpng8.2
- microcode_ctl: 2.1-26.xs26.1.xcpng8.2
- ocaml-rrd-transport: 1.16.1-7.1.xcpng8.2
- ocaml-rrdd-plugin: 1.9.1-7.1.xcpng8.2
- ocaml-tapctl: 1.5.1-7.1.xcpng8.2
- ocaml-xcp-idl: 1.96.5-1.1.xcpng8.2
- ocaml-xen-api-client: 1.9.0-10.1.xcpng8.2
- ocaml-xen-api-libs-transitional: 2.25.5-4.1.xcpng8.2
- rrd2csv: 1.2.6-7.1.xcpng8.2
- rrdd-plugins: 1.10.9-4.1.xcpng8.2
- sm-cli: 0.23.0-53.1.xcpng8.2
- squeezed-0.27.0-10.1.xcpng8.2
- varstored-guard: 0.6.2-7.xcpng8.2
- vhd-tool: 0.43.0-10.1.xcpng8.2
- wsproxy: 1.12.0-11.xcpng8.2
- xapi: 1.249.32-1.1.xcpng8.2
- xapi-nbd: 1.11.0-9.1.xcpng8.2
- xapi-storage: 11.19.0_sxm2-9.xcpng8.2
- xapi-storage-script: 0.34.1-8.1.xcpng8.2
- xcp-networkd: 0.56.2-7.xcpng8.2
- xcp-rrdd: 1.33.2-6.1.xcpng8.2
- xen: 4.13.5-9.36.1.xcpng8.2
- xenopsd: 0.150.17-1.1.xcpng8.2
- xs-opam-repo: 6.35.11-1.xcpng8.2
- guest-templates-json: 1.9.6-1.3.xcpng8.2
- blktap-3.37.4-1.0.2.xcpng8.2
- tzdata-2022a-1.el7
- xcp-ng-linstor-1.1-3.xcpng8.2
- nbd-3.24-1.xcpng8.2
- grub-2.02-3.2.0.xcpng8.2
What to test
Normal use and anything else you want to test. The closer to your actual use of XCP-ng, the better.
Test window before official release of the updates
~2 days.
-
-
RE: Updates announcements and testing
Hello,
Yes, these patches will become available in XCP-ng. We're working on it to release as soon as possible. We'd like to release them this week, so we do everything we can for that.
There will be a post here for the tests and for the final release.