Meltdown and Spectre encompass three different but related vulnerabilities and are listed under CVE-2017-5715, CVE-2017-5753 and CVE-2017-5754. So far, only patches for CVE-2017-5754 are available, so this document will cover those patches. It is worth noting that our underlying architecture protects your virtual servers against much of the vulnerability, but we still highly recommend patching your servers to keep your data safe.
Depending on the exact operating system your VPS is running you will have to make sure an up to date kernel version is installed and running. Generally you should be able to log into your VPS and be able to run the following command with root privileges:
root@hostname:~# uname -a
Linux hostname 4.4.0-45-generic #66-Ubuntu SMP Wed Oct 19 14:12:37 UTC 2016 x86_64 x86_64 x86_64 GNU/LinuxThe output of this command depends on the operating system you are running and the current patch state of your VPS.
Please refer to the following table for more information about which kernel version is regarded as patched for the CVE on which OS:
Operating System | Patched Linux Kernel version | Notes |
|---|---|---|
CentOS 6.6 | unstable | Don't update to the latest version just yet: |
CentOS 7 | 4.9.75 | https://lists.centos.org/pipermail/centos-announce/2018-January/022696.html |
Debian | ||
Debian Jessie | 3.16.51-3+deb8u1 | |
Debian Stretch | 4.9.65-3+deb9u2 | |
Debian Wheezy | 3.2.96-3 | |
Ubuntu | https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown | |
Ubuntu Precise | 3.2.0.132 | https://usn.ubuntu.com/usn/usn-3525-1/ |
Ubuntu Trusty | 3.13.0.139 | |
Ubuntu Xenial | 4.4.0.10 |
Once you have installed the new package version using your package manager make sure to double check which version is installed.
In order to output all installed package versions on Debian and Ubuntu use the following command:
root@hostname:~# dpkg -lOn CentOS VPSs use:
root@hostname:~# yum list installedOnce you have rebooted make sure that your machine is now running the correct kernel, like the following example of a Ubuntu Xenial server:
root@hostname:~# uname -a
Linux hostname 4.4.0-109-generic #132-Ubuntu SMP Tue Jan 9 19:52:39 UTC 2018 x86_64 x86_64 x86_64 GNU/LinuxIf your kernel is not showing the latest version, make sure the file '/boot/grub/menu.lst' has been updated and the boot entry is pointing to the correct files.
On the example system this would be looking like this:
title Ubuntu 16.04.3 LTS, kernel 4.4.0-109-generic
root (hd1)
kernel /boot/vmlinuz-4.4.0-109-generic root=/dev/xvda2 ro console=tty1
initrd /boot/initrd.img-4.4.0-109-generic