Suggest tweaks to meltdown advisory #4220
Conversation
k8s-ci-robot
added
size/M
| @@ -1,40 +1,35 @@ | |||
| ## Meltdown and Spectre Advisory | |||
| ## Kernel Update required for "Meltdown" issue | |||
There was a problem hiding this comment.
This addresses one of the Spectre issues as well.
| @@ -43,7 +38,8 @@ dmesg -H | grep 'page tables isolation' | |||
|
|
|||
| ## Impacted Maintained Component(s) | |||
|
|
|||
| - kops maintained AMI | |||
| * Patches were released for the linux kernel 2018-01-05. All images prior to this date likely need updates. | |||
There was a problem hiding this comment.
This is good information, but it does not match the heading.
|
|
||
| `kops get ig --name $CLUSTER` | ||
|
|
||
| #### Edit the kops instance groups | ||
| #### Replace the image for each instance group |
There was a problem hiding this comment.
They are not replacing. Maybe the wrong verb? They are modifying the cluster???
There was a problem hiding this comment.
Changing to Update the image for each instance group
docs/advisories/README.md
Outdated
| @@ -1,7 +1,8 @@ | |||
| ## kops Advisories | |||
|
|
|||
| - [Meltdown and Spectre](meltdown-spectre.md) | |||
| - [Meltdown Kernel Update Required](meltdown-kernel-update.md) | |||
There was a problem hiding this comment.
I am confused, as I am reading that one spectre cve and one meltdown cve was fixed.
From https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html
So far, there are three known variants of the issue:
Variant 1: bounds check bypass (CVE-2017-5753)
Variant 2: branch target injection (CVE-2017-5715)
Variant 3: rogue data cache load (CVE-2017-5754)
Before the issues described here were publicly disclosed, Daniel Gruss, Moritz Lipp, Yuval Yarom, Paul Kocher, Daniel Genkin, Michael Schwarz, Mike Hamburg, Stefan Mangard, Thomas Prescher and Werner Haas also reported them; their [writeups/blogposts/paper drafts] are at:
Spectre (variants 1 and 2)
Meltdown (variant 3)
There was a problem hiding this comment.
Grrr... I think you're right. I'll tweak - I'm just calling to call them spectre/meltdown. The separate CVEs are just muddying the waters IMO
Treat "spectre/meltdown" as one vuln, and stay away from parsing which CVE is which. The advisory is that the kernel must be updated, which CVEs are fixed (or not) are not really the issue.
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: chrislovecnm The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these OWNERS Files:
You can indicate your approval by writing |
k8s-ci-robot
added
the
approved
No description provided.