Notified:  August 11, 2015 Updated: September 14, 2015

Status

Affected

Vendor Statement

Basically if you care about this attack vector, disable deduplication.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Notified:  August 11, 2015 Updated: September 09, 2015

Status

Affected

Vendor Statement

- Virtuozzo 6 (formerly Parallels Cloud Server 6) Virtual Machines are not affected since our hypervisor does not utilize page sharing. - Virtuozzo 6 Containers are affected through "pfcache" feature (enabled by default), in the sense that from inside a Container you can find out whether any other container on the host has (or ever had) the particular application/file (of the particular version). We are considering this information leak a minor issue, which comes as a price for memory deduplication. We have no plans for fixing it. If this is considered a major threat by user, then it could be mitigated by disabling the "pfcache" functionality.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Notified:  August 11, 2015 Updated: October 06, 2015

Statement Date:   August 11, 2015

Status

Affected

Vendor Statement

This issue affects the versions of the Linux Kernel as shipped with Red Hat Enterprise Linux 4, 5, 6 and 7. Red Hat Product Security has rated this issue as having Low security impact. Additionally a workaround is available. A future update may address this issue. VMM layer: Deactivation of memory deduplication Deactivating memory deduplication will effectively mitigate all attack vectors. This measure unfortunately eliminates all the highly appreciated benefits of memory deduplication, namely the increase of operational cost-effectiveness through inter-VM memory sharing. Deactivating memory deduplication is the simplest way to prevent exploitation of this attack. However this will cause an increase in the amount of memory required and in some situations may adversely impact performance (e.g. due to slower swap space being used). It is recommended that customers test this workaround before using it in production.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-2877
• https://access.redhat.com/security/updates/classification/