Here's the bad news: We're going to keep seeing fundamental Intel CPU security holes popping open until every last one of the current generations of these chips is in landfills. Zombieland v2 is only the latest of a line of problems, which go back to Meltdown and Spectre. The "good" news is for now Intel and the operating system companies are staying ahead of hackers. Here's what Linux and Red Hat are doing about the latest nastiness.
First, Zombieland v2 isn't just a worry for people using older Intel processors. No, this shambler of a security hole can also be used against all recent Intel processors, including the latest and greatest Cascade Lake.
Specifically, Zombieland v2 is made up of three problems:
- Common Exposures and Vulnerabilities (CVE)-2018-12207: Machine Check Error on Page Size Change
- CVE-2019-11135: TSX Asynchronous Abort
- CVE-2019-0155 and CVE-2019-0154: i915 graphics driver holes.
When exploited, these security holes enable attackers to gain read access to your data or to hang your system
These are Microarchitectural Data Sampling (MDS) attacks. To protect your systems, you must patch both your Intel CPU microcode update and operating system. Doing just one or the other isn't enough.
Linux developers, as well as their counterparts at Apple and Microsoft, are ready with patches. From Red Hat, which tends to lead the way with Linux security, it's the first one that's the most troubling. It gives it a security ranking of important.
Specifically, the Page Size Changer bug can be used by a privileged attacker inside a guest Virtual Machine (VM) to crash the CPU. This, in turn, can bring down the entire system. This is not what you want a VM on your servers, or worse still, your cloud, doing.
Just because the other two aren't quite as bad doesn't mean that you can neglect them. Both can be used to spy on other users or to crash systems.
Unfortunately, while no one has done benchmarking yet, it's a given that you'll see performance hits. The first version of Zombieland slowed servers down by up to 40% on some workloads.
Performance or security? It's your choice, but I know which one I'd pick. To quote Red Hat: "Red Hat strongly suggests that users update all systems even if they do not believe their configuration poses a direct threat."
Patches are available for Red Hat Enterprise Linux (RHEL) via the Red Hat Customer Portal. You can find the patches need for Ubuntu at the Ubuntu Wiki Knowledge Base. For SUSE Linux Enterprise Server (SLES), see the SUSE Update Page.
So, what are you waiting for? For your data center servers to start going dark and your alarms to go off? Get patching. Now.