This knowledge base has moved to the documentation site. Please visit the knowledge base here for the most up to date content. This site is no longer maintained.

Meltdown and Spectre: Modern CPU Vulnerabilities


Update: Cumulus Networks released patches that fix these vulnerabilities. For information on how to apply the patches, read this article.

Note: This issue was announced on the Cumulus Networks security announcement mailing list on January 4, 2018.

CPU hardware implementations are vulnerable to side-channel attacks referred to as Meltdown and Spectre. These attacks are described in detail by CERT/CC's Vulnerability Note VU#584653, the United Kingdom National Cyber Security Centre’s guidance on Meltdown and Spectre, Google Project Zero (link is external), and the Institute of Applied Information Processing and Communications (IAIK) at Graz University of Technology (TU Graz). The Linux kernel mitigations for this vulnerability are referred to as KAISER, and subsequently KPTI, which aim to improve separation of kernel and user memory pages.

The Common Vulnerabilities and Exposures formally associated with Meltdown and Spectre are:

To exploit these vulnerabilities in Cumulus Linux, an attacker needs to have local access to the system.

Cumulus Networks is evaluating, porting, and testing patches to Cumulus Linux. Cumulus will release software updates as soon as they become available, and we will announce any updates on the cumulus-security-announce mailing list. At this point, the performance impact of the fixes is unclear; the extent of the impact depends on the operating system, the nature of the fix and the workload of the system.


This support portal has moved

Cumulus Networks is now part of the NVIDIA Networking Business Unit! The NVIDIA Cumulus Global Support Services (GSS) team has merged its operations with the NVIDIA Mellanox support services team.

You can access NVIDIA Cumulus support content from the Mellanox support portal.

You open and update new cases on the Mellanox support portal. Any previous cases that have been closed have been migrated to the Mellanox support portal.

Cases that are still open on the Cumulus portal will continue to be managed on the Cumulus portal. Once these cases close, they will be moved to the Mellanox support portal.

Powered by Zendesk