Adding cve updates for spectre and meltdown #4211

chrislovecnm · 2018-01-07T16:52:49Z

No description provided.

chrislovecnm · 2018-01-07T16:53:08Z

/area security

chrislovecnm · 2018-01-07T16:56:08Z

@KashifSaadat what is the coreos version that you are updating to?

KashifSaadat · 2018-01-07T17:00:10Z

Hey @chrislovecnm, the latest stable release which includes the related security fixes: https://coreos.com/releases/#1576.5.0

chrislovecnm · 2018-01-07T17:04:15Z

@KashifSaadat should we add an update about how to bump cores with kops?? I think Debian, CoreOS, and Ubuntu are the most used distros.

KashifSaadat · 2018-01-07T17:16:16Z

Sure. The update process would actually be the same as what you have documented in this PR, maybe include a note to say it also applies for CoreOS and Ubuntu?

chrislovecnm · 2018-01-07T17:26:07Z

We maybe should have the ami names??

justinsb · 2018-01-07T17:27:16Z

docs/advisories/cve_2017_5753.md

@@ -0,0 +1,20 @@
+## CVE-2017-5753


Not really sure what we're saying here - maybe separate out the two spectre CVEs until there's some action we're recommending?

HUH? There are three CVE's open, all listed by NVD.

But what are we recommending for the other two? I don't see why we're adding those two CVEs

Added a README.md so we can have the best of both worlds :)

justinsb · 2018-01-07T17:31:38Z

docs/advisories/cve_2017_5715.md

+
+##  Solutions
+
+This hardware exploit requires the installation of the Linux Kernel >= 4.4.110.


Let's reorder:

All platforms are affected, not just AWS

kops can run an image of your choice

Linux kernel versions needed: 4.4: >= 4.4.110, ...

By default, kops runs an image that includes the 4.4 kernel. An updated image is available with 4.4.110

If running another image please update to a fixed image, which must be provided by your distro

After update you will have to do an update & rolling-update.

Or maybe we swap kops can run with linux kernel versions needed... :-)

justinsb · 2018-01-07T17:32:16Z

docs/advisories/cve_2017_5715.md

+| NVD Severity 	| medium (attack range: local) |
+| Last Updated  | Jan 01 2018 |
+
+##  Solutions


Add how to know:

dmesg -H | grep 'page tables isolation' [ +0.000000] Kernel/User page tables isolation: enabled

If you don't see "Kernel/User page tables isolation: enabled", you are vulnerable.

justinsb · 2018-01-07T17:34:38Z

docs/advisories/cve_2017_5715.md

+
+### Impacted kops / kubernetes Components
+
+- kops ami


Let's just say all AMIs without the newer kernel are vulnerable. Likely all kernels built prior to 2018-01-03 are vulnerable.

justinsb · 2018-01-07T17:35:02Z

docs/advisories/cve_2017_5715.md

+- kope.io/k8s-1.8-debian-stretch-amd64-hvm-ebs-2018-01-05
+
+These are the images that are maintained by the kops project, please refer to
+other vendors for the appropriate AMI version.


justinsb · 2018-01-07T17:36:17Z

docs/advisories/cve_2017_5715.md

+
+`kops update $CLUSTER --yes`
+
+Perform a dry-run rolling-update, verifying that all intance groups will be


We switched from #### to inline here.

Maybe do this for each:

### Dry-run update Perform dry-run update, verifying that all instance groups are updated: `kops update $CLUSTER`

i.e. repeat, but keep headline short.

justinsb · 2018-01-07T17:36:38Z

docs/advisories/cve_2017_5715.md

+
+## Tools
+
+None at this time.


kops upgrade cluster soon :-)

won't that upgrade k8s as well??

justinsb · 2018-01-07T22:15:15Z

Let's not actively recommend the coreos update - there's a non-obvious kernel change (4.13 -> 4.14). If we want to, we can link to the CoreOS update docs instead https://coreos.com/blog/container-linux-meltdown-patch

This advisory covers the following 3 CVEs, Variant 1 and 3 are currently resolved. Variant 1: bounds check bypass (CVE-2017-5753) Variant 2: branch target injection (CVE-2017-5715) Variant 3: rogue data cache load (CVE-2017-5754)

chrislovecnm · 2018-01-08T01:19:38Z

/assign @justinsb

justinsb · 2018-01-08T02:56:57Z

docs/advisories/meltdown-spectre.md

+| Description  	| Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. 	|
+| CVE(s)       	| [CVE-2017-5753](https://nvd.nist.gov/vuln/detail/CVE-2017-5753)  [CVE-2017-5754](https://nvd.nist.gov/vuln/detail/CVE-2017-5753) |
+| NVD Severity 	| medium (attack range: local) |
+| Last Updated  | Jan 01 2018 |


What does this date mean?

Should be Jan 7 ... opps. The last date this document was updated.

justinsb · 2018-01-08T02:57:57Z

docs/advisories/meltdown-spectre.md

+
+##  Details
+
+This hardware exploit requires the installation of the Linux Kernel >= 4.4.110.


Can I suggest we cut this paragraph, and replace with:

* All unpatched versions of linux are vulnerable when running on affected hardware, across all platforms (AWS, GCE, etc) * Patches are included in Linux 4.4.110 for 4.4, 4.9.75 for 4.9, 4.14.12 for 4.14. * kops can run an image of your choice, so we can only provide detailed advice for the default image. * By default, kops runs an image that includes the 4.4 kernel. An updated image is available with the patched version (4.4.110). Users running the default image are strongly encouraged to upgrade. * If running another image please see your distro for upgraded images. * After updating the image, you will have to do an update & rolling-update.

np ... I do not like the last sentence, as I want them to read the actual instructions. But will add.

That's fair, though the instructions are still pretty vague here :-)

justinsb · 2018-01-08T02:58:17Z

docs/advisories/meltdown-spectre.md

+
+Three CVEs have been released with spectre and meltdown.
+
+- Variant 1: bounds check bypass (CVE-2017-5753)


Should this list match up with the list as before?

(i.e. why is 5715 here but not in the headline)

Three CVEs have been released with spectre and meltdown.

5715 is not fixed.

OK, but what is the purpose of the list at the top then? Do we believe that 5753 is fixed?

justinsb · 2018-01-08T02:58:25Z

docs/advisories/meltdown-spectre.md

+- Variant 2: branch target injection (CVE-2017-5715)
+- Variant 3: rogue data cache load (CVE-2017-5754)
+
+Currently, Variant 1 and Variant 3 are solved with this advisory.


That seems a bold statement.

I can say in the negative. Variant 2 is not addressed in this advisory?

I'd just go for clarity and honesty Maybe "This is a new and wide-ranging vulnerability, and there will probably be more updates over the coming months. The CVEs are differentiated by the means by which they exploit the same underlying vulnerability, and it is likely that more attack vectors will be found. This kernel update primarily aims to address CVE-2017-5754."

justinsb · 2018-01-08T03:00:13Z

docs/advisories/meltdown-spectre.md

+
+### Fixed Versions
+
+The following AMIs contain an updated kernel.


"For the kops-maintained AMIs, the following AMIs contain an updated kernel:"

justinsb · 2018-01-08T03:00:42Z

docs/advisories/meltdown-spectre.md

+
+#### Edit the kops instance groups 
+
+Update the instance group With the appropriate image version via a `kops 


Random upper case W

justinsb · 2018-01-08T03:02:56Z

docs/advisories/README.md

@@ -0,0 +1,6 @@
+## kops Advisories
+
+- [CVE 2017 14491](cve_2017_14491.md)


Maybe group by year, at least

Also sort in reverse order?

justinsb · 2018-01-08T03:04:07Z

docs/advisories/README.md

+- [CVE 2017 14491](cve_2017_14491.md)
+- [CVE 2017 5753](meltdown-spectre.md)
+- [CVE 2017 5754](meltdown-spectre.md)
+- [Meltdown and Spectre](meltdown-spectre.md)


One line per vuln methinks, no matter how many names they give it. Should make life easier for our users:

- [Meltdown and Spectre](meltdown-spectre.md) CVE-2017-5753, CVE-2017-5754, CVE-2017-5715

I would rather list each cve individually. More readable to me 🤷‍♂️

But for our users, they'll have to click through all 3 to see that they're one and the same.

Also, when we have another patch for the same CVE, what do we do then?

justinsb · 2018-01-08T03:05:40Z

docs/advisories/meltdown-spectre.md

+
+`kops rolling-update cluster --name $CLUSTER --yes`
+
+## Tools / Diagnosis


Putting myself in our user's shoes, I would want this closer to the top. I want to figure out if I am vulnerable before I decide to patch.

justinsb · 2018-01-08T03:07:19Z

docs/advisories/meltdown-spectre.md

+
+### Impacted kops / kubernetes Components
+
+- kops maintained AMI


How about:

"All linux kernels were vulnerable when running on affected hardware. Fixed in 4.4.110 for 4.4, 4.9.75 for 4.9, 4.14.12 for 4.14."

And replace this whole list (we're going to move it above)

justinsb · 2018-01-08T03:49:34Z

docs/advisories/README.md

+
+- [Meltdown and Spectre](meltdown-spectre.md)
+  - CVE-2017-5753
+  - CVE-2017-5754


justinsb · 2018-01-08T03:51:19Z

/lgtm

We're going to merge and I'm going to send a PR with my tweaks

k8s-ci-robot · 2018-01-08T03:51:23Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

~~OWNERS~~ [justinsb]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

AlexLast · 2018-01-08T08:59:48Z

docs/advisories/meltdown-spectre.md

+- kope.io/k8s-1.7-debian-jessie-amd64-hvm-ebs-2018-01-05
+- kope.io/k8s-1.8-debian-jessie-amd64-hvm-ebs-2018-01-05
+- kope.io/k8s-1.8-debian-stretch-amd64-hvm-ebs-2018-01-05
+- kope.io/k8s-1.8-debian-stretch-amd64-hvm-ebs-2018-01-05


Should this be here twice?

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 7, 2018

chrislovecnm added retest-not-required-docs-only and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 7, 2018

k8s-ci-robot added the area/security label Jan 7, 2018

chrislovecnm mentioned this pull request Jan 7, 2018

Update kops ami for cve issues - meltdown and spectre #4188

Closed

justinsb reviewed Jan 7, 2018

View reviewed changes

chrislovecnm force-pushed the spectre-meltdown-advisories branch from 27407ee to 2517987 Compare January 8, 2018 01:01

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jan 8, 2018

chrislovecnm force-pushed the spectre-meltdown-advisories branch 3 times, most recently from e908a2e to a6b8ffe Compare January 8, 2018 01:11

Adding cve updates for spectre and meltdown

9b77d88

This advisory covers the following 3 CVEs, Variant 1 and 3 are currently resolved. Variant 1: bounds check bypass (CVE-2017-5753) Variant 2: branch target injection (CVE-2017-5715) Variant 3: rogue data cache load (CVE-2017-5754)

chrislovecnm force-pushed the spectre-meltdown-advisories branch from a6b8ffe to 9b77d88 Compare January 8, 2018 01:18

k8s-ci-robot assigned justinsb Jan 8, 2018

justinsb reviewed Jan 8, 2018

View reviewed changes

chrislovecnm added 2 commits January 7, 2018 20:45

pr review udpates

0d7fc68

README tweaks from PR reviews

4ab033e

justinsb reviewed Jan 8, 2018

View reviewed changes

docs/advisories/README.md

- [Meltdown and Spectre](meltdown-spectre.md)

- CVE-2017-5753

- CVE-2017-5754

Copy link

Member

justinsb Jan 8, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 8, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 8, 2018

justinsb merged commit 0c9c9bc into kubernetes:master Jan 8, 2018

AlexLast reviewed Jan 8, 2018

View reviewed changes


		## Solutions

		This hardware exploit requires the installation of the Linux Kernel >= 4.4.110.


		`kops update $CLUSTER --yes`

		Perform a dry-run rolling-update, verifying that all intance groups will be


		## Details

		This hardware exploit requires the installation of the Linux Kernel >= 4.4.110.


		Three CVEs have been released with spectre and meltdown.

		- Variant 1: bounds check bypass (CVE-2017-5753)


		### Fixed Versions

		The following AMIs contain an updated kernel.


		#### Edit the kops instance groups

		Update the instance group With the appropriate image version via a `kops

		@@ -0,0 +1,6 @@
		## kops Advisories

		- [CVE 2017 14491](cve_2017_14491.md)


		`kops rolling-update cluster --name $CLUSTER --yes`

		## Tools / Diagnosis


		### Impacted kops / kubernetes Components

		- kops maintained AMI

Adding cve updates for spectre and meltdown #4211

Adding cve updates for spectre and meltdown #4211

Conversation

chrislovecnm commented Jan 7, 2018

chrislovecnm commented Jan 7, 2018

chrislovecnm commented Jan 7, 2018

KashifSaadat commented Jan 7, 2018

chrislovecnm commented Jan 7, 2018

KashifSaadat commented Jan 7, 2018 • edited Loading

chrislovecnm commented Jan 7, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

justinsb commented Jan 7, 2018

chrislovecnm commented Jan 8, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

justinsb commented Jan 8, 2018

k8s-ci-robot commented Jan 8, 2018

Choose a reason for hiding this comment

KashifSaadat commented Jan 7, 2018 •

edited

Loading