KVM, CentOS and CVE-2018-3639

Question

Today news have reached me about specter (https://access.redhat.com/security/cve/cve-2018-3639). I'm running CentOS and kvm infrastructure. Fix is critical and planning to deploy it in few days. I have running kvm VMs and in link is mentioned that VM complete shutdown and start is required. My question is that if I migrate VM from one KVM host (not updated) to another (updated) will it be enough? VMs are critical and complete shutdown and start circle is not a bets option.

Do you know something about that? Do you know how to test it if this enough? Please, share your knowledge

@ShahriarShojib No, I would like to do live migration to another host to keep VMs running in all upgrading process — gedO, May 25 '18 at 10:51

score 0 · Answer 1 · answered May 25 '18 at 17:32

0

Migrating the VM is not enough. You have to restart the VM on the updated host, otherwise the VM will not be protected.

answered May 25 '18 at 17:32

Tilman Schmidt

4,101
12
27

How about host? At this time I'm not concentrating to VMs security – gedO May 26 '18 at 14:40
If the VM is not protected it can be abused to attack the host. – Tilman Schmidt May 26 '18 at 23:34

KVM, CentOS and CVE-2018-3639

1 Answers1