{"id":8798,"date":"2018-01-05T01:28:24","date_gmt":"2018-01-05T01:28:24","guid":{"rendered":"https:\/\/qbytes.cloud\/?p=3713"},"modified":"2018-01-05T01:28:24","modified_gmt":"2018-01-05T01:28:24","slug":"fix-spectre-centos-rhel-fedora-oracle-scientific-linux","status":"publish","type":"post","link":"https:\/\/www.qbytes.cloud\/index.php\/2018\/01\/05\/fix-spectre-centos-rhel-fedora-oracle-scientific-linux\/","title":{"rendered":"Fix the Spectre on a CentOS\/RHEL\/Fedora\/Oracle\/Scientific Linux"},"content":{"rendered":"<p><a href=\"https:\/\/qbytes.cloud\/wp-content\/uploads\/2018\/01\/spectre-text.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-3707\" src=\"https:\/\/qbytes.cloud\/wp-content\/uploads\/2018\/01\/spectre-text-252x300.png\" alt=\"\" width=\"252\" height=\"300\" \/><\/a><\/p>\n<p>How to Fix the Spectre on a CentOS\/RHEL\/Fedora\/Oracle\/Scientific Linux<br \/>\nFor Example, CentOS 7<\/p>\n<p>Type the following yum command:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n# uname -r\n3.10.0-693.2.2.el7.x86_64\n\n<\/pre>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n# sudo yum update\n\n<\/pre>\n<p>CentOS 7 output<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">====================================================================================================================================================================================================\n Package                                            Arch                                  Version                                                      Repository                               Size\n=====================================================================================================================================================================================================\nInstalling:\n kernel                                             x86_64                                3.10.0-693.11.6.el7                                          updates                                  43 M\n kernel-devel                                       x86_64                                3.10.0-693.11.6.el7                                          updates                                  14 M\nUpdating:\n iwl100-firmware                                    noarch                                39.31.5.1-57.el7                                             updates                                 152 k\n iwl1000-firmware                                   noarch                                1:39.31.5.1-57.el7                                           updates                                 215 k\n iwl105-firmware                                    noarch                                18.168.6.1-57.el7                                            updates                                 236 k\n iwl135-firmware                                    noarch                                18.168.6.1-57.el7                                            updates                                 245 k\n iwl2000-firmware                                   noarch                                18.168.6.1-57.el7                                            updates                                 239 k\n iwl2030-firmware                                   noarch                                18.168.6.1-57.el7                                            updates                                 248 k\n iwl3160-firmware                                   noarch                                22.0.7.0-57.el7                                              updates                                 1.5 M\n iwl3945-firmware                                   noarch                                15.32.2.9-57.el7                                             updates                                  90 k\n iwl4965-firmware                                   noarch                                228.61.2.24-57.el7                                           updates                                 103 k\n iwl5000-firmware                                   noarch                                8.83.5.1_1-57.el7                                            updates                                 296 k\n iwl5150-firmware                                   noarch                                8.24.2.2-57.el7                                              updates                                 149 k\n iwl6000-firmware                                   noarch                                9.221.4.1-57.el7                                             updates                                 169 k\n iwl6000g2a-firmware                                noarch                                17.168.5.3-57.el7                                            updates                                 312 k\n iwl6000g2b-firmware                                noarch                                17.168.5.2-57.el7                                            updates                                 312 k\n iwl6050-firmware                                   noarch                                41.28.5.1-57.el7                                             updates                                 245 k\n iwl7260-firmware                                   noarch                                22.0.7.0-57.el7                                              updates                                 1.1 M\n kernel-headers                                     x86_64                                3.10.0-693.11.6.el7                                          updates                                 6.0 M\n kernel-tools                                       x86_64                                3.10.0-693.11.6.el7                                          updates                                 5.1 M\n kernel-tools-libs                                  x86_64                                3.10.0-693.11.6.el7                                          updates                                 5.1 M\n linux-firmware                                     noarch                                20170606-57.gitc990aae.el7                                   updates                                  35 M\n microcode_ctl                                      x86_64                                2:2.1-22.2.el7                                               updates                                 1.1 M\n python-perf                                        x86_64                                3.10.0-693.11.6.el7                                          updates                                 5.1 M\nRemoving:\n kernel                                             x86_64                                3.10.0-514.21.1.el7                                          @updates                                148 M\n\nTransaction Summary\n=====================================================================================================================================================================================================\nInstall   2 Packages\nUpgrade  22 Packages\nRemove    1 Package\n\nTotal download size: 120 M\nIs this ok &#x5B;y\/d\/N]:\n\n<\/pre>\n<p>You must reboot your Linux server using shutdown\/reboot command:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n$ sudo reboot\n\n<\/pre>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n$ uname -r\n3.10.0-693.11.6.el7.x86_64\n\n<\/pre>\n<p>Verify all 3 CVEs (you must see output:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n$ rpm -q --changelog kernel | egrep &#039;CVE-2017-5715|CVE-2017-5753|CVE-2017-5754&#039;\n\n<\/pre>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">&#x5B;root@webhost ~]# rpm -q --changelog kernel | egrep &#039;CVE-2017-5715|CVE-2017-5753|CVE-2017-5754&#039;\n- &#x5B;x86] spec_ctrl: Eliminate redundant FEATURE Not Present messages (Andrea Arcangeli) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] mm\/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Andrea Arcangeli) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Andrea Arcangeli) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] kaiser\/mm: skip IBRS\/CR3 restore when paranoid exception returns to userland (Andrea Arcangeli) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] kaiser\/mm: consider the init_mm.pgd a kaiser pgd (Andrea Arcangeli) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: Prevent unwanted speculation without IBRS (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715 CVE-2017-5754}\n- &#x5B;x86] entry: Remove trampoline check from paranoid entry path (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715 CVE-2017-5754}\n- &#x5B;x86] entry: Fix paranoid_exit() trampoline clobber (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715 CVE-2017-5754}\n- &#x5B;x86] entry: Simplify trampoline stack restore code (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715 CVE-2017-5754}\n- &#x5B;x86] spec_ctrl: remove SPEC_CTRL_DEBUG code (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: add noibrs noibpb boot options (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] entry: Use retpoline for syscall&#039;s indirect calls (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: cleanup unnecessary ptregscall_common function (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save\/restore (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] syscall: Clear unused extra registers on syscall entrance (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: rescan cpuid after a late microcode update (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: consolidate the spec control boot detection (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] KVM\/spec_ctrl: allow IBRS to stay enabled in host userland (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: add debug aid to test the entry code without microcode (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] mm: Only set IBPB when the new thread cannot ptrace current thread (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] mm: Set IBPB upon context switch (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] idle: Disable IBRS when offlining cpu and re-enable on wakeup (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] idle: Disable IBRS entering idle and enable it on wakeup (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: implement spec ctrl C methods (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] enter: Use IBRS on syscall and interrupts (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] enter: MACROS to set\/clear IBRS and set IBPB (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] svm: Set IBPB when running a different VCPU (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;kvm] vmx: Set IBPB when running a different VCPU (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;kvm] x86: clear registers on VM exit (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] kvm: pad RSB on VM transition (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] cpu\/AMD: Control indirect branch predictor when SPEC_CTRL not available (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] feature: Report presence of IBPB and IBRS control (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;x86] feature: Enable the x86 feature to control Speculation (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;tools] objtool: Don&#039;t print &#039;call dest&#039; warnings for ignored functions (Josh Poimboeuf) &#x5B;1519795 1519798] {CVE-2017-5715}\n- &#x5B;misc] locking\/barriers: prevent speculative execution based on Coverity scan results (Josh Poimboeuf) &#x5B;1519788 1519786] {CVE-2017-5753}\n- &#x5B;fs] udf: prevent speculative execution (Josh Poimboeuf) &#x5B;1519788 1519786] {CVE-2017-5753}\n- &#x5B;fs] prevent speculative execution (Josh Poimboeuf) &#x5B;1519788 1519786] {CVE-2017-5753}\n- &#x5B;kernel] userns: prevent speculative execution (Josh Poimboeuf) &#x5B;1519788 1519786] {CVE-2017-5753}\n- &#x5B;scsi] qla2xxx: prevent speculative execution (Josh Poimboeuf) &#x5B;1519788 1519786] {CVE-2017-5753}\n- &#x5B;netdrv] p54: prevent speculative execution (Josh Poimboeuf) &#x5B;1519788 1519786] {CVE-2017-5753}\n- &#x5B;netdrv] carl9170: prevent speculative execution (Josh Poimboeuf) &#x5B;1519788 1519786] {CVE-2017-5753}\n- &#x5B;media] uvcvideo: prevent speculative execution (Josh Poimboeuf) &#x5B;1519788 1519786] {CVE-2017-5753}\n- &#x5B;x86] cpu\/AMD: Remove now unused definition of MFENCE_RDTSC feature (Josh Poimboeuf) &#x5B;1519788 1519786] {CVE-2017-5753}\n- &#x5B;x86] cpu\/AMD: Make the LFENCE instruction serialized (Josh Poimboeuf) &#x5B;1519788 1519786] {CVE-2017-5753}\n- &#x5B;misc] locking\/barriers: introduce new memory barrier gmb() (Josh Poimboeuf) &#x5B;1519788 1519786] {CVE-2017-5753}\n- &#x5B;x86] mm\/kaiser: Replace kaiser with kpti to sync with upstream (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: add &quot;kaiser&quot; and &quot;nokaiser&quot; boot options (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: map the trace idt tables in userland shadow pgd (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: fix RESTORE_CR3 crash in kaiser_stop_machine (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: use stop_machine for enable\/disable knob (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: use atomic ops to poison\/unpoison user pagetables (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: use invpcid to flush the two kaiser PCID AISD (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: use two PCID ASIDs optimize the TLB during enter\/exit kernel (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: stop patching flush_tlb_single (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: use PCID feature to make user and kernel switches faster (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm: If INVPCID is available, use it to flush global mappings (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/64: Fix reboot interaction with CR4.PCIDE (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/64: Initialize CR4.PCIDE early (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm: Add a &#039;noinvpcid&#039; boot option to turn off INVPCID (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm: Add the &#039;nopcid&#039; boot option to turn off PCID (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: validate trampoline stack (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: isolate the user mapped per cpu areas (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: enable kaiser in build (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: selective boot time defaults (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: handle call to xen_pv_domain() on PREEMPT_RT (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser\/xen: Dynamically disable KAISER when running under Xen PV (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: add Kconfig (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: avoid false positives during non-kaiser pgd updates (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: Respect disabled CPU features (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: trampoline stack comments (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: stack trampoline (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: remove paravirt clock warning (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: re-enable vsyscalls (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: allow to build KAISER with KASRL (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: allow KAISER to be enabled\/disabled at runtime (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: un-poison PGDs at runtime (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: add a function to check for KAISER being enabled (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: add debugfs file to turn KAISER on\/off at runtime (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: disable native VSYSCALL (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: map virtually-addressed performance monitoring buffers (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: map debug IDT tables (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: add kprobes text section (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: map trace interrupt entry (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: map entry stack per-cpu areas (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: map dynamically-allocated LDTs (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: make sure static PGDs are 8k in size (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: allow NX poison to be set in p4d\/pgd (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: unmap kernel from userspace page tables (core patch) (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: mark per-cpu data structures required for entry\/exit (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: introduce user-mapped per-cpu areas (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: add cr3 switches to entry code (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: remove scratch registers (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: prepare assembly for entry\/exit CR3 switching (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/kaiser: Disable global pages by default with KAISER (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm: Document X86_CR4_PGE toggling behavior (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm\/tlb: Make CR4-based TLB flushes more robust (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] mm: Do not set _PAGE_USER for init_mm page tables (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;x86] increase robusteness of bad_iret fixup handler (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;perf] x86\/intel\/uncore: Fix memory leaks on allocation failures (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;mm] userfaultfd: hugetlbfs: prevent UFFDIO_COPY to fill beyond the end of i_size (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;fs] userfaultfd: non-cooperative: fix fork use after free (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;mm] userfaultfd: hugetlbfs: remove superfluous page unlock in VM_SHARED case (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n- &#x5B;mm] fix bad rss-counter if remap_file_pages raced migration (Josh Poimboeuf) &#x5B;1519800 1519801] {CVE-2017-5754}\n\n<\/pre>\n<p>Run the following dnf command if you are using a Fedora Linux:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n# sudo dnf --refresh update kernel\n\n<\/pre>\n<p>OR<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n# sudo dnf update\n\n<\/pre>\n<p>Reboot the Linux box:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n$ sudo reboot\n\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>How to Fix the Spectre on a CentOS\/RHEL\/Fedora\/Oracle\/Scientific Linux For Example, CentOS 7 Type the following yum command: # uname -r 3.10.0-693.2.2.el7.x86_64 # sudo yum update CentOS 7 output ==================================================================================================================================================================================================== Package Arch Version Repository Size ===================================================================================================================================================================================================== Installing: kernel x86_64 3.10.0-693.11.6.el7 updates 43 M kernel-devel x86_64 3.10.0-693.11.6.el7 updates 14 M Updating: iwl100-firmware noarch 39.31.5.1-57.el7 updates 152 &#8230; <a title=\"Fix the Spectre on a CentOS\/RHEL\/Fedora\/Oracle\/Scientific Linux\" class=\"read-more\" href=\"https:\/\/www.qbytes.cloud\/index.php\/2018\/01\/05\/fix-spectre-centos-rhel-fedora-oracle-scientific-linux\/\" aria-label=\"Read more about Fix the Spectre on a CentOS\/RHEL\/Fedora\/Oracle\/Scientific Linux\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-8798","post","type-post","status-publish","format-standard","hentry","category-administration"],"_links":{"self":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/posts\/8798","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=8798"}],"version-history":[{"count":0,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/posts\/8798\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=8798"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=8798"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=8798"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}