In the last several weeks, many of you have likely heard about the new security threat that involves the ability to exploit common features of modern CPUs. These attacks, known as “Meltdown” and “Spectre” can impact both bare metal and virtual servers. Red Hat Virtualization has added the “IBRS Family” of CPUs to the supported Cluster CPU type as a means to help protect against the IPRS and IBPM attacks that would result in guest attacks.
NOTE: The first step towards protecting your Red Hat Virtualization environment is to update all components to the latest version. RHV and/or RHEL hosts should be updated, Red Hat Virtualization Manager should be updated, and all guests should be updated.
The feature outlined below is available starting in Red Hat Virtualization 4.1.9 with the use of Intel Nehalem and newer CPUs, when the appropriate microcode is applied to the host(s). After updating the environment and then the Red Hat Virtualization Cluster CPU type to use a IBRS CPU Type (Spectre Variant 2 protection), all VMs in that cluster need to be stopped & started.
In the screenshots below we see the information displayed for a VM, with the guest CPU highlighted. The Intel Broadwell (IBRS) family is indicated,
In this next screenshot, the hypervisor host kernel sysfs settings are highlighted, specifically regarding PTI (Meltdown), IBPB and IBRS (Spectre):
In this last screenshot, the host CPU type is highlighted - an IBRS family model capable of protecting guests using this type against in-guest attacks:
For more information on Meltdown and Spectre, please see this tutorial. For additional information on how to update Red Hat Virtualization to protect against Meltdown and Spectre, please see this knowledge base article.
Hope this helps,
Captain KVM
About the author
Browse by channel
Automation
The latest on IT automation for tech, teams, and environments
Artificial intelligence
Updates on the platforms that free customers to run AI workloads anywhere
Open hybrid cloud
Explore how we build a more flexible future with hybrid cloud
Security
The latest on how we reduce risks across environments and technologies
Edge computing
Updates on the platforms that simplify operations at the edge
Infrastructure
The latest on the world’s leading enterprise Linux platform
Applications
Inside our solutions to the toughest application challenges
Original shows
Entertaining stories from the makers and leaders in enterprise tech
Products
- Red Hat Enterprise Linux
- Red Hat OpenShift
- Red Hat Ansible Automation Platform
- Cloud services
- See all products
Tools
- Training and certification
- My account
- Customer support
- Developer resources
- Find a partner
- Red Hat Ecosystem Catalog
- Red Hat value calculator
- Documentation
Try, buy, & sell
Communicate
About Red Hat
We’re the world’s leading provider of enterprise open source solutions—including Linux, cloud, container, and Kubernetes. We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.
Select a language
Red Hat legal and privacy links
- About Red Hat
- Jobs
- Events
- Locations
- Contact Red Hat
- Red Hat Blog
- Diversity, equity, and inclusion
- Cool Stuff Store
- Red Hat Summit