Question Plesk Onyx & CentOS - Meltdown and Spectre security update

[durian808]

Hi,

I am attempting to update CentOS 7 to the current version, in order to install the kernel security patch.

My Plesk Onyx version is: 17.0.17 Update #42, last updated on Dec 27, 2017 03:21 AM

If I start the CentOS update from the shell, yum reports that kernel.x86_64 0:3.10.0-693.11.6.el7 will be installed. (I have not proceeded with this.)

3.10.0-693.11.6.el7 is the latest kernel, updated on Jan. 4, which contains the security patches:
Index of /c7.1708.u.x86_64/kernel/20180104010318

See also: [CentOS-announce] CESA-2018:0007 Important CentOS 7 kernel Security Update

However, if I look at the system updates in Plesk, "All Packages", it reports that kernel 3.10.0-123.el7 (anaconda) is installed and up-to-date. It does this even after I click Check for Updates.

Please advise how to proceed.

thanks,
JC

 

[speedbird]

Don't look at the plesk package description.

SSH into the server and look at "uname -a" to see which version you are running. I just ran the manual update itself and installed the new kernel. No problems so far. After reboot "uname -a" showed the correct new version number.

 

[IgorG]

Here is official Plesk document about this vulnerablility - Meltdown vulnerability

 

[Trung Ma]

Hi IgorG,

after I run " yum update". I don't see any package for update kernel. what should I do?

Regards,
Trung Ma

 

[IgorG]

This means that you have installed all latest updates from your enabled repository.

 

[Trung Ma]

Thank IgorG, but I don't see any change from kernel version after reboot server, I try to verify protection and don't see any result.
I'm using Plesk on container Virtuozzo.

 

[IgorG]

I'm using Plesk on container Virtuozzo.

In this case, you have to update kernel of Virtuozzo hardware node. VPS hasn't own kernel

 

[virtubox]

To check easily if your server is vulnerable to spectre and meltdown vulnerabilities , there is a bash script available on Github :
GitHub - speed47/spectre-meltdown-checker: Spectre & Meltdown vulnerability/mitigation checker for Linux

You can run it with the following command :

bash <(wget --no-check-certificate -O - https://raw.githubusercontent.com/speed47/spectre-meltdown-checker/master/spectre-meltdown-checker.sh)

 

[Trung Ma]

In this case, you have to update kernel of Virtuozzo hardware node. VPS hasn't own kernel

Thank IgorG,
How about with Virtual Machine on VMWare ESXi.

Regards,
Trung Ma

 

[IgorG]

How about with Virtual Machine on VMWare ESXi.

Sorry, but I'm not familiar with it.

 

[virtubox]

Thank IgorG,
How about with Virtual Machine on VMWare ESXi.

Regards,
Trung Ma

You can upgrade your kernel on a VM running on VMware ESXI , it's not the same than OpenVZ. But ESXI hosts also need to be patched.

 

[Trung Ma]

In this case, you have to update kernel of Virtuozzo hardware node. VPS hasn't own kernel

Thank IgorG,

After updating for Virtuozzo server, I have the new kernel version like as link Important kernel security update: Fixes ...
Regards,