Security bulletins

From time to time, we might release security bulletins related to Compute Engine. All security bulletins for Compute Engine are described here.

Use this XML feed to subscribe to Compute Engine security bulletins.

GCP-2024-040

Published: 2024-07-01
Updated: 2024-08-20

Description Severity Notes

Updated: 2024-08-20 Critical CVE-2024-6387

Description	Severity	Notes
Updated: 2024-08-20	Critical	CVE-2024-6387
2024-08-20: Include patches for TPUs. Apply updates from Linux distributions as they become available. Please refer to guidance from Linux distributions. If you are using TPUs, please update to one of the following patched versions: tpu-ubuntu2204-base v2-alpha-tpuv5 v2-alpha-tpuv5-lite A vulnerability (CVE-2024-6387) has been discovered in OpenSSH. Successful exploitation of this vulnerability allows a remote, unauthenticated attacker to execute arbitrary code as root on the target machine. All Compute Engine VMs that use a glibc-based Linux distribution and have OpenSSH exposed are recommended to be analyzed for the vulnerable versions. What should I do? Apply updates from Linux distributions as they become available. Please refer to guidance from Linux distributions. For Google's Container-Optimized OS, please update to one of the following patched versions: cos-113-18244-85-49 cos-109-17800-218-69 cos-105-17412-370-67 cos-101-17162-463-55 If you are using Container-Optimized OS through a Google managed service (e.g. GKE), please refer to that service's security bulletin for patch availability. If updating is not possible, consider turning OpenSSH off until it can be patched. The default network is pre-populated with a `default-allow-ssh` firewall rule to allow ssh access from the public Internet. To remove this access, customers can: Optionally create rules to allow any SSH access you need from trusted networks to GKE nodes or other Compute Engine VMs in the project; then Disable the default firewall rule with the following command: gcloud compute firewall-rules update default-allow-ssh --disabled --project=$PROJECT If you have created any other firewall rules that may allow SSH through TCP on port 22, disable them, or limit the source IPs to trusted networks. Verify that you can no longer ssh to your VMs from the Internet. This firewall configuration mitigates the vulnerability. If OpenSSH needs to be left on, you can also execute a configuration update which eliminates the race case condition for the exploit. This is a runtime mitigation. To apply the changes in the sshd config, this script will restart the sshd service. #!/bin/bash set -e SSHD_CONFIG_FILE=/etc/ssh/sshd_config # -c: count the matches # -q: don't print to console # -i: sshd_config keywords are case insensitive. if [[ "$(grep -ci '^LoginGraceTime' $SSHD_CONFIG_FILE)" -eq 0 ]]; then echo "LoginGraceTime 0" >> "$SSHD_CONFIG_FILE" echo "Set the LoginGraceTime to 0 in $SSHD_CONFIG_FILE" else sed -i 's/^LoginGraceTime.*$/LoginGraceTime 0/' /etc/ssh/sshd_config echo "Changed the LoginGraceTime to 0 in $SSHD_CONFIG_FILE" fi # Restart the sshd service to apply the new config. systemctl restart sshd Finally, monitor for any unusual network activity involving SSH servers.	Critical	CVE-2024-6387

2024-08-20: Include patches for TPUs. Apply updates from Linux distributions as they become available. Please refer to guidance from Linux distributions. If you are using TPUs, please update to one of the following patched versions:

tpu-ubuntu2204-base
v2-alpha-tpuv5
v2-alpha-tpuv5-lite

A vulnerability (CVE-2024-6387) has been discovered in OpenSSH. Successful exploitation of this vulnerability allows a remote, unauthenticated attacker to execute arbitrary code as root on the target machine.

All Compute Engine VMs that use a glibc-based Linux distribution and have OpenSSH exposed are recommended to be analyzed for the vulnerable versions.

What should I do?

Apply updates from Linux distributions as they become available. Please refer to guidance from Linux distributions. For Google's Container-Optimized OS, please update to one of the following patched versions:
- cos-113-18244-85-49
- cos-109-17800-218-69
- cos-105-17412-370-67
- cos-101-17162-463-55
If you are using Container-Optimized OS through a Google managed service (e.g. GKE), please refer to that service's security bulletin for patch availability.
If updating is not possible, consider turning OpenSSH off until it can be patched. The default network is pre-populated with a default-allow-ssh firewall rule to allow ssh access from the public Internet. To remove this access, customers can:
1. Optionally create rules to allow any SSH access you need from trusted networks to GKE nodes or other Compute Engine VMs in the project; then
2. Disable the default firewall rule with the following command:
```
gcloud compute firewall-rules update default-allow-ssh --disabled --project=$PROJECT
      
```
If you have created any other firewall rules that may allow SSH through TCP on port 22, disable them, or limit the source IPs to trusted networks.

Verify that you can no longer ssh to your VMs from the Internet. This firewall configuration mitigates the vulnerability.

If OpenSSH needs to be left on, you can also execute a configuration update which eliminates the race case condition for the exploit. This is a runtime mitigation. To apply the changes in the sshd config, this script will restart the sshd service.

#!/bin/bash
set -e

SSHD_CONFIG_FILE=/etc/ssh/sshd_config
# -c: count the matches
# -q: don't print to console
# -i: sshd_config keywords are case insensitive.
if [[ "$(grep -ci '^LoginGraceTime' $SSHD_CONFIG_FILE)" -eq 0 ]]; then
    echo "LoginGraceTime 0" >> "$SSHD_CONFIG_FILE"
    echo "Set the LoginGraceTime to 0 in $SSHD_CONFIG_FILE"
else
    sed -i 's/^LoginGraceTime.*$/LoginGraceTime 0/' /etc/ssh/sshd_config
    echo "Changed the LoginGraceTime to 0 in $SSHD_CONFIG_FILE"
fi
# Restart the sshd service to apply the new config.
systemctl restart sshd

Finally, monitor for any unusual network activity involving SSH servers.

Critical

CVE-2024-6387

GCP-2024-021

Published: 2024-04-03

Description	Severity	Notes
Compute Engine is not affected by CVE-2024-3094, which affects versions 5.6.0 and 5.6.1 of the xz-utils package in the liblzma library, and could lead to compromise of the OpenSSH utility. What should I do? Public images supported and offered by Compute Engine are not affected by this CVE. If you use Compute Engine public images for your VMs, no action is required. You could be at risk if you created a custom image that used versions 5.6.0 and 5.6.1 of xz-utils package, such as the following operating systems: Fedora 41 and Fedora Rawhide Debian testing/unstable openSUSE tumbleweed To mitigate this risk, stop any VMs that use these operating systems or others that could have used affected operating systems. If you have VMs built from custom images of other operating systems, check with your OS vendor to see if your VMs are affected. What vulnerabilities are being addressed? CVE-2024-3094	Medium	CVE-2024-3094

Description

Severity

Notes

Compute Engine is not affected by CVE-2024-3094, which affects versions 5.6.0 and 5.6.1 of the xz-utils package in the liblzma library, and could lead to compromise of the OpenSSH utility.

What should I do?

Public images supported and offered by Compute Engine are not affected by this CVE. If you use Compute Engine public images for your VMs, no action is required.

You could be at risk if you created a custom image that used versions 5.6.0 and 5.6.1 of xz-utils package, such as the following operating systems:

To mitigate this risk, stop any VMs that use these operating systems or others that could have used affected operating systems. If you have VMs built from custom images of other operating systems, check with your OS vendor to see if your VMs are affected.

What vulnerabilities are being addressed?

CVE-2024-3094

Medium

CVE-2024-3094

GCP-2024-001

Published: 2024-01-09

Description	Severity	Notes
Several vulnerabilities were discovered in the TianoCore EDK II UEFI firmware. This firmware is used in Google Compute Engine VMs. If exploited, the vulnerabilities could allow a bypass of secure boot, which would provide false measurements in the secure boot process, including when used in Shielded VMs. What should I do? No action is required. Google has patched this vulnerability across Compute Engine and all VMs are protected from this vulnerability. What vulnerabilities are addressed by this patch? The patch mitigated the following vulnerabilities: CVE-2022-36763 CVE-2022-36764 CVE-2022-36765	Medium	CVE-2022-36763 CVE-2022-36764 CVE-2022-36765

Description

Severity

Notes

Several vulnerabilities were discovered in the TianoCore EDK II UEFI firmware. This firmware is used in Google Compute Engine VMs. If exploited, the vulnerabilities could allow a bypass of secure boot, which would provide false measurements in the secure boot process, including when used in Shielded VMs.

What should I do?

No action is required. Google has patched this vulnerability across Compute Engine and all VMs are protected from this vulnerability.

What vulnerabilities are addressed by this patch?

The patch mitigated the following vulnerabilities:

CVE-2022-36763
CVE-2022-36764
CVE-2022-36765

Medium

GCP-2023-44

Published: 2023-11-15

Description	Severity	Notes
On November 14, AMD disclosed multiple vulnerabilities that impact various AMD server CPUs. Specifically, the vulnerabilities impact EPYC Server CPUs leveraging Zen core generation 2 "Rome," gen 3 "Milan," and gen 4 "Genoa." Google has applied fixes to affected assets, including Google Cloud, to ensure customers are protected. At this time, no evidence of exploitation has been found or reported to Google. What should I do? No customer action is required. Fixes have already been applied to the Google server fleet for Google Cloud, including Google Compute Engine. What vulnerabilities are addressed by this patch? The patch mitigated the following vulnerabilities: CVE-2022-23820 CVE-2021-46774 CVE-2023-20533 CVE-2023-20519 CVE-2023-20592 CVE-2023-20566 CVE-2023-20521 CVE-2021-46766 CVE-2022-23830 CVE-2023-20526 CVE-2021-26345 For more information, see AMD's security advisory AMD-SN-3005: "AMD INVD Instruction Security Notice", also published as CacheWarp, and AMD-SN-3002: "AMD Server Vulnerabilities – November 2023".	Medium	CVE-2022-23820 CVE-2021-46774 CVE-2023-20533 CVE-2023-20519 CVE-2023-20592 CVE-2023-20566 CVE-2022-23830 CVE-2023-20526 CVE-2021-26345

Description

Severity

Notes

On November 14, AMD disclosed multiple vulnerabilities that impact various AMD server CPUs. Specifically, the vulnerabilities impact EPYC Server CPUs leveraging Zen core generation 2 "Rome," gen 3 "Milan," and gen 4 "Genoa."

Google has applied fixes to affected assets, including Google Cloud, to ensure customers are protected. At this time, no evidence of exploitation has been found or reported to Google.

What should I do?

No customer action is required.

Fixes have already been applied to the Google server fleet for Google Cloud, including Google Compute Engine.

What vulnerabilities are addressed by this patch?

The patch mitigated the following vulnerabilities:

CVE-2022-23820
CVE-2021-46774
CVE-2023-20533
CVE-2023-20519
CVE-2023-20592
CVE-2023-20566
CVE-2023-20521
CVE-2021-46766
CVE-2022-23830
CVE-2023-20526
CVE-2021-26345

For more information, see AMD's security advisory AMD-SN-3005: "AMD INVD Instruction Security Notice", also published as CacheWarp, and AMD-SN-3002: "AMD Server Vulnerabilities – November 2023".

Medium

GCP-2023-004

Published: 2023-04-26

Description	Severity	Notes
Two vulnerabilities (CVE-2023-1017 and CVE-2023-1018) were discovered in Trusted Platform Module (TPM) 2.0. The vulnerabilities could have allowed a sophisticated attacker to exploit a 2-byte out of bounds read/write on certain Compute Engine VMs. What should I do? A patch was automatically applied to all vulnerable VMs. No customer action is required. What vulnerabilities are addressed by this patch? The patch mitigated the following vulnerabilities: CVE-2023-1017 With CVE-2023-2017, a buffer overrun could be triggered in the vTPM parameter decryption routine. A local attacker running on a vulnerable VM could use this to trigger a denial-of-service or possibly execute arbitrary code in the vTPM context. CVE-2023-1018 With CVE-2023-2018, an out-of-bounds read existed in the vTPM parameter decryption routine. A local attacker running on a vulnerable VM could use this to indirectly leak limited data from the vTPM context.	Medium	CVE-2023-1017 CVE-2023-1018

Description

Severity

Notes

Two vulnerabilities (CVE-2023-1017 and CVE-2023-1018) were discovered in Trusted Platform Module (TPM) 2.0.

The vulnerabilities could have allowed a sophisticated attacker to exploit a 2-byte out of bounds read/write on certain Compute Engine VMs.

What should I do?

A patch was automatically applied to all vulnerable VMs. No customer action is required.

What vulnerabilities are addressed by this patch?

The patch mitigated the following vulnerabilities:

CVE-2023-1017

With CVE-2023-2017, a buffer overrun could be triggered in the vTPM parameter decryption routine. A local attacker running on a vulnerable VM could use this to trigger a denial-of-service or possibly execute arbitrary code in the vTPM context.

CVE-2023-1018

With CVE-2023-2018, an out-of-bounds read existed in the vTPM parameter decryption routine. A local attacker running on a vulnerable VM could use this to indirectly leak limited data from the vTPM context.

Medium

GCP-2021-026

Published: 2021-12-14

Description	Severity	Notes
The Apache Log4j utility is a commonly used component for logging requests. On December 9, 2021, a vulnerability was reported that could allow a system running Apache Log4j version 2.14.1 or below to be compromised and allow an attacker to execute arbitrary code. On December 10, 2021, NIST published a critical Common Vulnerabilities and Exposure alert, CVE-2021-44228. More specifically, Java Naming Directory Interface (JNDI) features used in configuration, log messages, and parameters don't protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from remote servers when message lookup substitution is enabled. What should I do? M4CE v4.x: The Migrate for Compute Engine (M4CE) Team has provided a new version on 13 December, 2021. Project managers are required to replace the existing deployment with the new version including in-cloud M4CE Manager and M4CE "on premises" backend. See the How to Guide for details on version 4.11 deploy details. M2VMs v5.x: M2VMs v5.0 and above has been fixed and no action is required.	Critical	CVE-2021-44228

Description

Severity

Notes

The Apache Log4j utility is a commonly used component for logging requests. On December 9, 2021, a vulnerability was reported that could allow a system running Apache Log4j version 2.14.1 or below to be compromised and allow an attacker to execute arbitrary code.

On December 10, 2021, NIST published a critical Common Vulnerabilities and Exposure alert, CVE-2021-44228. More specifically, Java Naming Directory Interface (JNDI) features used in configuration, log messages, and parameters don't protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from remote servers when message lookup substitution is enabled.

What should I do?

M4CE v4.x: The Migrate for Compute Engine (M4CE) Team has provided a new version on 13 December, 2021. Project managers are required to replace the existing deployment with the new version including in-cloud M4CE Manager and M4CE "on premises" backend. See the How to Guide for details on version 4.11 deploy details.
M2VMs v5.x: M2VMs v5.0 and above has been fixed and no action is required.

Critical

CVE-2021-44228

GCP-2021-001

Published: 2021-01-28

Description Severity Notes

Description	Severity	Notes
A vulnerability was recently discovered in the Linux utility `sudo`, described in CVE-2021-3156, that might allow an attacker with unprivileged local shell access on a system with `sudo` installed to escalate their privileges to root on the system. Compute Engine impact The underlying infrastructure that runs Compute Engine is not impacted by this vulnerability. Compute Engine VMs running Linux should consider updating their guest operating system. For example, if you use a Container-Optimized OS, we recommend you update to one of the following images: cos-85-13310-1209-7, cos-81-12871-1245-6, cos-dev-89-16091-0-0, or later.	None	CVE-2021-3156

A vulnerability was recently discovered in the Linux utility sudo, described in CVE-2021-3156, that might allow an attacker with unprivileged local shell access on a system with sudo installed to escalate their privileges to root on the system.

Compute Engine impact

The underlying infrastructure that runs Compute Engine is not impacted by this vulnerability. Compute Engine VMs running Linux should consider updating their guest operating system. For example, if you use a Container-Optimized OS, we recommend you update to one of the following images: cos-85-13310-1209-7, cos-81-12871-1245-6, cos-dev-89-16091-0-0, or later.

None

CVE-2021-3156

Date published: 2020-08-27

Description Severity Notes

Description	Severity	Notes
Eclypsium has disclosed the following CVE: CVE-2020-10713. Vulnerabilities In response to the initial vulnerability report, additional scrutiny was applied to the GRUB2 code and the following additional vulnerabilities were discovered by Canonical: CVE-2020-14308 CVE-2020-14309 CVE-2020-14310 CVE-2020-14311 CVE-2020-15705 CVE-2020-15706 CVE-2020-15707 These vulnerabilities, collectively referred to as BootHole, allow unsigned binaries to be loaded by attackers with administrative privileges, thus disabling secure boot enforcement. Compute Engine impact The host infrastructure that runs Compute Engine is protected against known attacks. Compute Engine customers who use secure boot are encouraged to update the guest operating systems on their instances to prevent the possibility of exploitation within their guest environments. For details, refer to your Guest OS Vendor's recommended mitigation. Patched images and vendor resources We will provide links to patch information from each operating system vendor here as they become available. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks: Project `centos-cloud`: CentOS patch information `centos-7-v20200811` `centos-8-v20200811` Project `cos-cloud`: `cos-77-12371-1072-0` `cos-81-12871-1185-0` `cos-rc-85-13310-1028-0` `cos-dev-86-15103-0-0` If you are using COS through a managed service (e.g. GKE), please follow the guidance for that service to apply updates. Project `debian-cloud`: DSA-4753 `debian-10-buster-v20200805` Project `coreos-cloud`: `coreos-alpha-2163-2-1-v20190617` `coreos-beta-2135-3-1-v20190617` `coreos-stable-2079-6-0-v20190617` Project `rhel-cloud/rhel-sap-cloud:` Red Hat Vulnerability Response `rhel-7-v20200811` `rhel-7-4-sap-v20200811` `rhel-7-6-sap-v20200811` `rhel-7-7-sap-v20200811` `rhel-8-v20200811` Project `suse-cloud/suse-sap-cloud:`: SUSE KB `sles-12-sp5-v20200813` `sles-15-sp2-v20200804` `sles-12-sp4-sap-v20200804` `sles-12-sp5-sap-v20200813` `sles-15-sap-v20200803` `sles-15-sp1-sap-v20200803` `Sles-15-sp2-sap-v20200804` Project `ubuntu-os-cloud`: Ubuntu Wiki `ubuntu-1604-xenial-v20200729` `ubuntu-1804-bionic-v20200729` `ubuntu-2004-focal-v20200729`	High	CVE-2020-10713 CVE-2020-14308 CVE-2020-14309 CVE-2020-14310 CVE-2020-14311 CVE-2020-15705 CVE-2020-15706 CVE-2020-15707

Eclypsium has disclosed the following CVE: CVE-2020-10713.

Vulnerabilities

In response to the initial vulnerability report, additional scrutiny was applied to the GRUB2 code and the following additional vulnerabilities were discovered by Canonical:

These vulnerabilities, collectively referred to as BootHole, allow unsigned binaries to be loaded by attackers with administrative privileges, thus disabling secure boot enforcement.

Compute Engine impact

The host infrastructure that runs Compute Engine is protected against known attacks.

Compute Engine customers who use secure boot are encouraged to update the guest operating systems on their instances to prevent the possibility of exploitation within their guest environments. For details, refer to your Guest OS Vendor's recommended mitigation.

Patched images and vendor resources

We will provide links to patch information from each operating system vendor here as they become available. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks:

Project centos-cloud: CentOS patch information
- centos-7-v20200811
- centos-8-v20200811
Project cos-cloud:
- cos-77-12371-1072-0
- cos-81-12871-1185-0
- cos-rc-85-13310-1028-0
- cos-dev-86-15103-0-0
If you are using COS through a managed service (e.g. GKE), please follow the guidance for that service to apply updates.
Project debian-cloud: DSA-4753
- debian-10-buster-v20200805
Project coreos-cloud:
- coreos-alpha-2163-2-1-v20190617
- coreos-beta-2135-3-1-v20190617
- coreos-stable-2079-6-0-v20190617
Project rhel-cloud/rhel-sap-cloud: Red Hat Vulnerability Response
- rhel-7-v20200811
- rhel-7-4-sap-v20200811
- rhel-7-6-sap-v20200811
- rhel-7-7-sap-v20200811
- rhel-8-v20200811
Project suse-cloud/suse-sap-cloud:: SUSE KB
- sles-12-sp5-v20200813
- sles-15-sp2-v20200804
- sles-12-sp4-sap-v20200804
- sles-12-sp5-sap-v20200813
- sles-15-sap-v20200803
- sles-15-sp1-sap-v20200803
- Sles-15-sp2-sap-v20200804
Project ubuntu-os-cloud: Ubuntu Wiki
- ubuntu-1604-xenial-v20200729
- ubuntu-1804-bionic-v20200729
- ubuntu-2004-focal-v20200729

High

Date published: 2020-06-19

Description Severity Notes

Description	Severity	Notes
VMs that have OS Login enabled might be susceptible to privilege escalation vulnerabilities. These vulnerabilities gives users that are granted OS Login permissions (but not given administrator access) the ability to escalate to root access in the VM. Vulnerabilities The following three vulnerabilities, which are due to overly permissive default group memberships, were identified for Compute Engine images: CVE-2020-8903: by using the `adm` user, you can take advantage of the DHCP XID to obtain administrative privileges. CVE-2020-8907: by using the `docker` user, you can mount and modify the host OS file system to obtain administrative privileges. CVE-2020-8933: by using the `lxd` user, you can attach host OS file systems and obtain administrative privileges. Patched images and fixes All Compute Engine public images created after `v20200506` are patched. If you need to fix this issue without updating to a later version of your image, you can edit the `/etc/security/group.conf` file and remove the `adm`, `lxd` and `docker` users from the default OS Login entry.	High	CVE-2020-8903 CVE-2020-8907 CVE-2020-8933

VMs that have OS Login enabled might be susceptible to privilege escalation vulnerabilities. These vulnerabilities gives users that are granted OS Login permissions (but not given administrator access) the ability to escalate to root access in the VM.

Vulnerabilities

The following three vulnerabilities, which are due to overly permissive default group memberships, were identified for Compute Engine images:

CVE-2020-8903: by using the adm user, you can take advantage of the DHCP XID to obtain administrative privileges.
CVE-2020-8907: by using the docker user, you can mount and modify the host OS file system to obtain administrative privileges.
CVE-2020-8933: by using the lxd user, you can attach host OS file systems and obtain administrative privileges.

Patched images and fixes

All Compute Engine public images created after v20200506 are patched.

If you need to fix this issue without updating to a later version of your image, you can edit the /etc/security/group.conf file and remove the adm, lxd and docker users from the default OS Login entry.

High

Date published: 2020-01-21

Description Severity Notes

Description	Severity	Notes
Microsoft disclosed the following vulnerability: CVE-2020-0601— This vulnerability is also known as the Windows Crypto API Spoofing Vulnerability and could be exploited to make malicious executables appear trusted or allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. Compute Engine impact The underlying infrastructure that runs Compute Engine is not impacted by this vulnerability. Unless you are running Windows Server in your Compute Engine virtual machine, no further action is required. Customers using Compute Engine VMs running Windows Server should ensure their instances have the latest Windows patch. Patched images and vendor resources Earlier versions of the public Windows images don't contain the following patches and don't mitigate potential attacks: Projects `windows-cloud` and `windows-sql-cloud` All Windows Server and SQL Server public images starting from v20200114	Medium	CVE-2020-0601

Microsoft disclosed the following vulnerability:

CVE-2020-0601— This vulnerability is also known as the Windows Crypto API Spoofing Vulnerability and could be exploited to make malicious executables appear trusted or allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.

Compute Engine impact

The underlying infrastructure that runs Compute Engine is not impacted by this vulnerability. Unless you are running Windows Server in your Compute Engine virtual machine, no further action is required. Customers using Compute Engine VMs running Windows Server should ensure their instances have the latest Windows patch.

Patched images and vendor resources

Earlier versions of the public Windows images don't contain the following patches and don't mitigate potential attacks:

Projects windows-cloud and windows-sql-cloud
- All Windows Server and SQL Server public images starting from v20200114

Medium

CVE-2020-0601

Date published: 2019-11-12

Description	Severity	Notes
Intel has disclosed the following CVEs: CVE-2019-11135— This CVE is also known as TSX Async Abort (TAA). TAA provides another avenue for data exfiltration using the same microarchitectural data structures that were exploited by Microarchitectural Data Sampling (MDS). CVE-2018-12207— This CVE is also known as "Machine Check Error on Page Size Change." This is a Denial of Service (DoS) vulnerability affecting virtual machine hosts allowing a malicious guest to crash an unprotected host. Compute Engine impact CVE-2019-11135 The host infrastructure that runs Compute Engine isolates customer workloads. Unless you are running untrusted code inside N2, C2, or M2 VMs, no further action is required. N2, C2, or M2 customers running untrusted code in their own multi-tenant services within Compute Engine virtual machines should stop and start their VMs in order to ensure they have the latest security mitigations. A reboot, without a stop/start, is not sufficient. This guidance assumes you have already applied previously released updates covering the MDS vulnerability. If not, please follow the instructions to apply the appropriate updates. For customers running N1 machine types, no action is required, as this vulnerability does not represent new exposure beyond the previously disclosed MDS vulnerabilities. CVE-2018-12207 The host infrastructure that runs Compute Engine is protected from this vulnerability. No further action is required.	Medium	CVE-2019-11135 CVE-2018-12207

Description

Severity

Notes

Intel has disclosed the following CVEs:

CVE-2019-11135— This CVE is also known as TSX Async Abort (TAA). TAA provides another avenue for data exfiltration using the same microarchitectural data structures that were exploited by Microarchitectural Data Sampling (MDS).
CVE-2018-12207— This CVE is also known as "Machine Check Error on Page Size Change." This is a Denial of Service (DoS) vulnerability affecting virtual machine hosts allowing a malicious guest to crash an unprotected host.

Compute Engine impact

CVE-2019-11135

The host infrastructure that runs Compute Engine isolates customer workloads. Unless you are running untrusted code inside N2, C2, or M2 VMs, no further action is required.

N2, C2, or M2 customers running untrusted code in their own multi-tenant services within Compute Engine virtual machines should stop and start their VMs in order to ensure they have the latest security mitigations. A reboot, without a stop/start, is not sufficient. This guidance assumes you have already applied previously released updates covering the MDS vulnerability. If not, please follow the instructions to apply the appropriate updates.

For customers running N1 machine types, no action is required, as this vulnerability does not represent new exposure beyond the previously disclosed MDS vulnerabilities.

CVE-2018-12207

The host infrastructure that runs Compute Engine is protected from this vulnerability. No further action is required.

Medium

Date published: 2019-06-18

last updated: 2019-06-25 T 6:30 PST

Description Severity Notes

Description	Severity	Notes
Netflix has recently disclosed three TCP vulnerabilities in Linux kernels: CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 These CVEs are collectively referred to as NFLX-2019-001. Compute Engine impact The infrastructure that hosts Compute Engine is protected from this vulnerability. Compute Engine VMs running unpatched Linux operating systems that send/receive untrusted network traffic are vulnerable to this DoS attack. Consider updating these VM instances as soon as patches are available for their operating systems. Load balancers that close TCP connections have been patched against this vulnerability. Compute Engine instances that receive only untrusted traffic through these load balancers are not vulnerable. This includes HTTP Load Balancers, SSL Proxy Load Balancers, and TCP Proxy Load Balancers. Network load balancers and internal load balancers don't close TCP connections. Unpatched Compute Engine instances that receive untrusted traffic through these load balancers are vulnerable. Patched images and vendor resources We will provide links to patch information from each operating system vendor here as they become available, including the status for each CVE. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks: Project `debian-cloud`: `debian-9-stretch-v20190618` Project `centos-cloud`: `centos-6-v20190619` `centos-7-v20190619` Project `cos-cloud`: `cos-dev-77-12293-0-0` `cos-beta-76-12239-21-0` `cos-stable-75-12105-77-0` `cos-73-11647-217-0` `cos-69-10895-277-0` Project `coreos-cloud`: `coreos-alpha-2163-2-1-v20190617` `coreos-beta-2135-3-1-v20190617` `coreos-stable-2079-6-0-v20190617` Project `rhel-cloud`: `rhel-6-v20190618` `rhel-7-v20190618` `rhel-8-v20190618` Project `rhel-sap-cloud`: `rhel-7-4-sap-v20190618` `rhel-7-6-sap-v20190618` Project `suse-cloud`: `sles-12-sp4-v20190617` `sles-15-v20190617` Project `suse-sap-cloud`: `sles-12-sp1-sap-v20190617` `sles-12-sp2-sap-v20190617` `sles-12-sp3-sap-v20190617` `sles-12-sp4-sap-v20190617` `sles-15-sap-v20190617` Project `ubuntu-cloud`: `ubuntu-1604-xenial-v20190617` `ubuntu-1804-bionic-v20190617` `ubuntu-1810-cosmic-v20190618` `ubuntu-1904-disco-v20190619` `ubuntu-minimal-1604-xenial-v20190618` `ubuntu-minimal-1804-bionic-v20190617` `ubuntu-minimal-1810-cosmic-v20190618` `ubuntu-minimal-1904-disco-v20190618`	Medium	CVE-2019-11477 CVE-2019-11478 CVE-2019-11479

Netflix has recently disclosed three TCP vulnerabilities in Linux kernels:

These CVEs are collectively referred to as NFLX-2019-001.

Compute Engine impact

The infrastructure that hosts Compute Engine is protected from this vulnerability.

Compute Engine VMs running unpatched Linux operating systems that send/receive untrusted network traffic are vulnerable to this DoS attack. Consider updating these VM instances as soon as patches are available for their operating systems.

Load balancers that close TCP connections have been patched against this vulnerability. Compute Engine instances that receive only untrusted traffic through these load balancers are not vulnerable. This includes HTTP Load Balancers, SSL Proxy Load Balancers, and TCP Proxy Load Balancers.

Network load balancers and internal load balancers don't close TCP connections. Unpatched Compute Engine instances that receive untrusted traffic through these load balancers are vulnerable.

Patched images and vendor resources

We will provide links to patch information from each operating system vendor here as they become available, including the status for each CVE. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks:

Project debian-cloud:
- debian-9-stretch-v20190618
Project centos-cloud:
- centos-6-v20190619
- centos-7-v20190619
Project cos-cloud:
- cos-dev-77-12293-0-0
- cos-beta-76-12239-21-0
- cos-stable-75-12105-77-0
- cos-73-11647-217-0
- cos-69-10895-277-0
Project coreos-cloud:
- coreos-alpha-2163-2-1-v20190617
- coreos-beta-2135-3-1-v20190617
- coreos-stable-2079-6-0-v20190617
Project rhel-cloud:
- rhel-6-v20190618
- rhel-7-v20190618
- rhel-8-v20190618
Project rhel-sap-cloud:
- rhel-7-4-sap-v20190618
- rhel-7-6-sap-v20190618
Project suse-cloud:
- sles-12-sp4-v20190617
- sles-15-v20190617
Project suse-sap-cloud:
- sles-12-sp1-sap-v20190617
- sles-12-sp2-sap-v20190617
- sles-12-sp3-sap-v20190617
- sles-12-sp4-sap-v20190617
- sles-15-sap-v20190617
Project ubuntu-cloud:
- ubuntu-1604-xenial-v20190617
- ubuntu-1804-bionic-v20190617
- ubuntu-1810-cosmic-v20190618
- ubuntu-1904-disco-v20190619
- ubuntu-minimal-1604-xenial-v20190618
- ubuntu-minimal-1804-bionic-v20190617
- ubuntu-minimal-1810-cosmic-v20190618
- ubuntu-minimal-1904-disco-v20190618

Medium

Date published: 2019-05-14

last updated: 2019-05-20 T 17:00 PST

Description Severity Notes

Description	Severity	Notes
Intel has disclosed the following CVEs: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 These CVEs are collectively referred to as Microarchitectural Data Sampling (MDS). These vulnerabilities potentially allow data to be exposed using the interaction of speculative execution with microarchitectural state. Compute Engine impact The host infrastructure that runs Compute Engine isolates customer workloads from each other. Unless you are running untrusted code inside your VMs, no further action is required. For customers running untrusted code in their own multi-tenant services within Compute Engine virtual machines, refer to your Guest OS Vendor's recommended mitigation, which might include using Intel's microcode mitigation features. We have deployed guest pass-through access to the new flush functionality. The following is a summary of mitigation steps available for common guest images. Patched images and vendor resources We will provide links to patch information from each operating system vendor here as they become available, including status for each CVE. Use these images to recreate VM instances. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks: Project `centos-cloud`: CESA-2019:1169, CESA-2019:1168 `centos-6-v20190515` `centos-7-v20190515` Project `coreos-cloud`: MDS mitigations for CoreOS Container Linux `coreos-stable-2079-4-0-v20190515` `coreos-beta-2107-3-0-v20190515` `coreos-alpha-2135-1-0-v20190515` Project `cos-cloud` `cos-69-10895-242-0` `cos-73-11647-182-0` Project `debian-cloud`: DSA-4444 `debian-9-stretch-v20190514` Project `rhel-cloud`: Red Hat MDS Knowledge Article `rhel-6-v20190515` `rhel-7-v20190517` `rhel-8-v20190515` Project `rhel-sap-cloud`: Red Hat MDS Knowledge Article `rhel-7-4-sap-v20190515` `rhel-7-6-sap-v20190517` Project `suse-cloud`: SUSE MDS KB `sles-12-sp4-v20190520` `sles-15-v20190520` Project `suse-sap-cloud` `sles-12-sp4-sap-v20190520` `sles-15-sap-v20190520` Project `ubuntu-os-cloud`: Ubuntu MDS Wiki `ubuntu-1404-trusty-v20190514` `ubuntu-1604-xenial-v20190514` `ubuntu-1804-bionic-v20190514` `ubuntu-1810-cosmic-v20190514` `ubuntu-1904-disco-v20190514` `ubuntu-minimal-1604-xenial-v20190514` `ubuntu-minimal-1804-bionic-v20190514` `ubuntu-minimal-1810-cosmic-v20190514` `ubuntu-minimal-1904-disco-v20190514` Projects `windows-cloud` and `windows-sql-cloud`: Microsoft ADV190013 All Windows Server and SQL Server public images with version number `v20190514`. Project `gce-uefi-images` `centos-7-v20190515` `cos-69-10895-242-0` `cos-73-11647-182-0` `rhel-7-v20190517` `ubuntu-1804-bionic-v20190514` All Windows Server public images with version number `v20190514`. Container-Optimized OS If you are using Container Optimized OS (COS) as your Guest OS and you are running untrusted, multi-tenant workloads in your virtual machine, we recommend that you: Disable Hyper-Threading by setting `nosmt` on the kernel command-line. On existing COS VMs, you can modify the `grub.cfg` as follows to set the `nosmt` option and then reboot the system: # Run as root: dir="$(mktemp -d)" mount /dev/sda12 "${dir}" sed -i -e "s\|cros_efi\|cros_efi nosmt\|g" "${dir}/efi/boot/grub.cfg" umount "${dir}" rmdir "${dir}" reboot For convenience, you can run the script below to achieve the same result as running the commands earlier. We recommend making this script part of your cloud-config, startup scripts or instance templates, to ensure that new VMs use this new parameter. An example cloud-config that runs this script is below. Warning: This command will result in an immediate reboot of the instance when run for the first time. Subsequent runs of the command on an instance with Hyper-Threading already disabled will have no effect. # Run as root /bin/bash <(curl -s https://storage.googleapis.com/cos-tools/scripts/disable_smt.sh) To include this as part of your cloud-config: #cloud-config bootcmd: - /bin/bash -c "/bin/bash <(curl -s https://storage.googleapis.com/cos-tools/scripts/disable_smt.sh)" To confirm if Hyper-Threading is disabled on your instance, look at the output of `/sys/devices/system/cpu/smt/active` and `/sys/devices/system/cpu/smt/control` files. If it returns `0` for `active` and `off` for `control`, Hyper-Threading is disabled: cat /sys/devices/system/cpu/smt/active cat /sys/devices/system/cpu/smt/control Note: If you have enabled UEFI Secure Boot on your instance, you will need to re-create your instance with UEFI Secure Boot disabled, run the above command with UEFI Secure Boot disabled, and then enable UEFI Secure Boot on your new instance. Use new version of COS image In addition to disabling Hyper-Threading as described above, you should also re-create your instances with the updated images listed above or newer versions (when available) of Container-Optimized OS images to get fully protected from the vulnerability.	Medium	CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091

Intel has disclosed the following CVEs:

These CVEs are collectively referred to as Microarchitectural Data Sampling (MDS). These vulnerabilities potentially allow data to be exposed using the interaction of speculative execution with microarchitectural state.

Compute Engine impact

The host infrastructure that runs Compute Engine isolates customer workloads from each other. Unless you are running untrusted code inside your VMs, no further action is required.

For customers running untrusted code in their own multi-tenant services within Compute Engine virtual machines, refer to your Guest OS Vendor's recommended mitigation, which might include using Intel's microcode mitigation features. We have deployed guest pass-through access to the new flush functionality. The following is a summary of mitigation steps available for common guest images.

Patched images and vendor resources

We will provide links to patch information from each operating system vendor here as they become available, including status for each CVE. Use these images to recreate VM instances. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks:

Project centos-cloud: CESA-2019:1169, CESA-2019:1168

centos-6-v20190515
centos-7-v20190515

Project coreos-cloud: MDS mitigations for CoreOS Container Linux

coreos-stable-2079-4-0-v20190515
coreos-beta-2107-3-0-v20190515
coreos-alpha-2135-1-0-v20190515

Project cos-cloud

cos-69-10895-242-0
cos-73-11647-182-0

Project debian-cloud: DSA-4444

debian-9-stretch-v20190514

Project rhel-cloud: Red Hat MDS Knowledge Article

rhel-6-v20190515
rhel-7-v20190517
rhel-8-v20190515

Project rhel-sap-cloud: Red Hat MDS Knowledge Article

rhel-7-4-sap-v20190515
rhel-7-6-sap-v20190517

Project suse-cloud: SUSE MDS KB

sles-12-sp4-v20190520
sles-15-v20190520

Project suse-sap-cloud

sles-12-sp4-sap-v20190520
sles-15-sap-v20190520

Project ubuntu-os-cloud: Ubuntu MDS Wiki

ubuntu-1404-trusty-v20190514
ubuntu-1604-xenial-v20190514
ubuntu-1804-bionic-v20190514
ubuntu-1810-cosmic-v20190514
ubuntu-1904-disco-v20190514
ubuntu-minimal-1604-xenial-v20190514
ubuntu-minimal-1804-bionic-v20190514
ubuntu-minimal-1810-cosmic-v20190514
ubuntu-minimal-1904-disco-v20190514

Projects windows-cloud and windows-sql-cloud: Microsoft ADV190013

All Windows Server and SQL Server public images with version number v20190514.

Project gce-uefi-images

centos-7-v20190515
cos-69-10895-242-0
cos-73-11647-182-0
rhel-7-v20190517
ubuntu-1804-bionic-v20190514
All Windows Server public images with version number v20190514.

Container-Optimized OS

If you are using Container Optimized OS (COS) as your Guest OS and you are running untrusted, multi-tenant workloads in your virtual machine, we recommend that you:

Disable Hyper-Threading by setting nosmt on the kernel command-line.

On existing COS VMs, you can modify the grub.cfg as follows to set the nosmt option and then reboot the system:
```
# Run as root:
dir="$(mktemp -d)"
mount /dev/sda12 "${dir}"
sed -i -e "s|cros_efi|cros_efi nosmt|g" "${dir}/efi/boot/grub.cfg"
umount "${dir}"
rmdir "${dir}"

reboot
```
For convenience, you can run the script below to achieve the same result as running the commands earlier. We recommend making this script part of your cloud-config, startup scripts or instance templates, to ensure that new VMs use this new parameter. An example cloud-config that runs this script is below.

Warning: This command will result in an immediate reboot of the instance when run for the first time. Subsequent runs of the command on an instance with Hyper-Threading already disabled will have no effect.
```
# Run as root
/bin/bash <(curl -s https://storage.googleapis.com/cos-tools/scripts/disable_smt.sh)
```
To include this as part of your cloud-config:
```
#cloud-config

bootcmd:
- /bin/bash -c "/bin/bash <(curl -s https://storage.googleapis.com/cos-tools/scripts/disable_smt.sh)"
```
To confirm if Hyper-Threading is disabled on your instance, look at the output of /sys/devices/system/cpu/smt/active and /sys/devices/system/cpu/smt/control files. If it returns 0 for active and off for control, Hyper-Threading is disabled:
```
cat /sys/devices/system/cpu/smt/active
cat /sys/devices/system/cpu/smt/control
```
Note: If you have enabled UEFI Secure Boot on your instance, you will need to re-create your instance with UEFI Secure Boot disabled, run the above command with UEFI Secure Boot disabled, and then enable UEFI Secure Boot on your new instance.
Use new version of COS image

In addition to disabling Hyper-Threading as described above, you should also re-create your instances with the updated images listed above or newer versions (when available) of Container-Optimized OS images to get fully protected from the vulnerability.

Medium

Date published: 2018-08-14

last updated: 2018-08-20 T 17:00 PST

Description Severity Notes

Description	Severity	Notes
Description Intel has disclosed the following CVEs: CVE-2018-3615 (for SGX) CVE-2018-3620 (for operating systems and SMT) CVE-2018-3646 (for virtualization) These CVEs are collectively referred to as "L1 Terminal Fault (L1TF)". These L1TF vulnerabilities exploit speculative execution by attacking the configuration of processor-level data structures. "L1" refers to the Level-1 Data cache (L1D), a small on-core resource used to accelerate memory access. Read the Google Cloud blog post for more details on these vulnerabilities and Compute Engine's mitigations. Compute Engine impact The host infrastructure that runs Compute Engine and isolates customer workloads from each other is protected against known attacks. Compute Engine customers are encouraged to update their images to prevent the possibility of indirect exploitation within their guest environments. This is particularly important for customers running their own multi-tenant services on Compute Engine virtual machines. Compute Engine customers can update the guest operating systems on their instances using one of the following options: Use patched public images to recreate existing VM instances. On existing instances, install patches provided by the operating system vendor and reboot the patched instances. Patched images and vendor resources We will provide links to patch information from each operating system vendor here as they become available, including status for both CVEs. Use these images to recreate VM instances. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks: Project `centos-cloud`: `centos-7-v20180815` `centos-6-v20180815` Project `coreos-cloud`: `coreos-stable-1800-7-0-v20180816` `coreos-beta-1855-2-0-v20180816` `coreos-alpha-1871-0-0-v20180816` Project `cos-cloud`: `cos-stable-66-10452-110-0` `cos-stable-67-10575-66-0` `cos-beta-68-10718-81-0` `cos-dev-69-10895-23-0` Project `debian-cloud`: `debian-9-stretch-v20180820` Project `rhel-cloud`: `rhel-7-v20180814` `rhel-6-v20180814` Project `rhel-sap-cloud`: `rhel-7-sap-apps-v20180814` `rhel-7-sap-hana-v20180814` Project `suse-cloud`: `sles-15-v20180816` `sles-12-sp3-v20180814` `sles-11-sp4-v20180816` Project `suse-sap-cloud`: `sles-15-sap-v20180816` `sles-12-sp3-sap-v20180814` `sles-12-sp2-sap-v20180816` Project `ubuntu-os-cloud`: `ubuntu-1804-bionic-v20180814` `ubuntu-1604-xenial-v20180814` `ubuntu-1404-trusty-v20180814` `ubuntu-minimal-1804-bionic-v20180814` `ubuntu-minimal-1604-xenial-v20180814` Projects `windows-cloud` `gce-uefi-images` and `windows-sql-cloud`: All Windows Server and SQL Server public images with version number `-v201800814` and later include patches.	High	CVE-2018-3615 CVE-2018-3620 CVE-2018-3646

Description

Intel has disclosed the following CVEs:

CVE-2018-3615 (for SGX)
CVE-2018-3620 (for operating systems and SMT)
CVE-2018-3646 (for virtualization)

These CVEs are collectively referred to as "L1 Terminal Fault (L1TF)".

These L1TF vulnerabilities exploit speculative execution by attacking the configuration of processor-level data structures. "L1" refers to the Level-1 Data cache (L1D), a small on-core resource used to accelerate memory access.

Read the Google Cloud blog post for more details on these vulnerabilities and Compute Engine's mitigations.

Compute Engine impact

The host infrastructure that runs Compute Engine and isolates customer workloads from each other is protected against known attacks.

Compute Engine customers are encouraged to update their images to prevent the possibility of indirect exploitation within their guest environments. This is particularly important for customers running their own multi-tenant services on Compute Engine virtual machines.

Compute Engine customers can update the guest operating systems on their instances using one of the following options:

Use patched public images to recreate existing VM instances.
On existing instances, install patches provided by the operating system vendor and reboot the patched instances.

Patched images and vendor resources

We will provide links to patch information from each operating system vendor here as they become available, including status for both CVEs. Use these images to recreate VM instances. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks:

Project centos-cloud:
- centos-7-v20180815
- centos-6-v20180815
Project coreos-cloud:
- coreos-stable-1800-7-0-v20180816
- coreos-beta-1855-2-0-v20180816
- coreos-alpha-1871-0-0-v20180816
Project cos-cloud:
- cos-stable-66-10452-110-0
- cos-stable-67-10575-66-0
- cos-beta-68-10718-81-0
- cos-dev-69-10895-23-0
Project debian-cloud:
- debian-9-stretch-v20180820
Project rhel-cloud:
- rhel-7-v20180814
- rhel-6-v20180814
Project rhel-sap-cloud:
- rhel-7-sap-apps-v20180814
- rhel-7-sap-hana-v20180814
Project suse-cloud:
- sles-15-v20180816
- sles-12-sp3-v20180814
- sles-11-sp4-v20180816
Project suse-sap-cloud:
- sles-15-sap-v20180816
- sles-12-sp3-sap-v20180814
- sles-12-sp2-sap-v20180816
Project ubuntu-os-cloud:
- ubuntu-1804-bionic-v20180814
- ubuntu-1604-xenial-v20180814
- ubuntu-1404-trusty-v20180814
- ubuntu-minimal-1804-bionic-v20180814
- ubuntu-minimal-1604-xenial-v20180814
Projects windows-cloud gce-uefi-images and windows-sql-cloud:
- All Windows Server and SQL Server public images with version number -v201800814 and later include patches.

High

Date published: 2018-08-06

last updated: 2018-09-05 T 17:00 PST

Description Severity Notes

Description	Severity	Notes
2018-09-05 Update CVE-2018-5391 was disclosed on 2018-08-14 by US-CERT. As with CVE-2018-5390, this is a kernel-level networking vulnerability that increases the effectiveness of denial of service (DoS) attacks against vulnerable systems. The main difference is that CVE-2018-5391 is exploitable over IP connections. We updated this bulletin to cover both vulnerabilities. Description CVE-2018-5390 ("SegmentSmack") describes a kernel-level networking vulnerability that increases the effectiveness of denial of service (DoS) attacks against vulnerable systems over TCP connections. CVE-2018-5391 ("FragmentSmack") describes a kernel-level networking vulnerability that increases the effectiveness of denial of service (DoS) attacks against vulnerable systems over IP connections. Compute Engine impact The host infrastructure that runs Compute Engine VMs is not at risk. The network infrastructure that handles traffic to and from Compute Engine VMs is protected against this vulnerability. Compute Engine VMs that only send/receive untrusted network traffic using HTTP(S), SSL, or TCP Load Balancers are protected against this vulnerability. Compute Engine VMs running unpatched operating systems that send/receive untrusted network traffic directly, or using Network Load Balancers, are vulnerable to this DoS attack. Consider updating your VM instances as soon as patches are available for their operating systems. Compute Engine customers can update the guest operating systems on their instances using one of the following options: Use patched public images to recreate existing VM instances. See the list of patched public images below. On existing instances, install patches provided by the operating system vendor and reboot the patched instances. Patched images and vendor resources We will provide links to patch information from each operating system vendor here as they become available. Project `centos-cloud` (CVE-2018-5390 only): `centos-7-v20180815` `centos-6-v20180815` Project `coreos-cloud` (CVE-2018-5390 and CVE-2018-5391): `coreos-stable-1800-7-0-v20180816` `coreos-beta-1855-2-0-v20180816` `coreos-alpha-1871-0-0-v20180816` Project `cos-cloud` (CVE-2018-5390 and CVE-2018-5391): `cos-stable-65-10323-98-0` `cos-stable-66-10452-109-0` `cos-stable-67-10575-65-0` `cos-beta-68-10718-76-0` `cos-dev-69-10895-16-0` Project `debian-cloud` (CVE-2018-5390 and CVE-2018-5391): `debian-9-stretch-v20180814` Project `rhel-cloud` (CVE-2018-5390 only): `rhel-7-v20180814` `rhel-6-v20180814` Project `suse-cloud` (CVE-2018-5390 and CVE-2018-5391): `sles-15-v20180816` `sles-12-sp3-v20180814` Project `suse-sap-cloud` (CVE-2018-5390 and CVE-2018-5391): `sles-15-sap-v20180816` `sles-12-sp3-sap-v20180814` `sles-12-sp2-sap-v20180816` Project `ubuntu-os-cloud` (CVE-2018-5390 and CVE-2018-5391): `ubuntu-1804-bionic-v20180814` `ubuntu-1604-xenial-v20180814` `ubuntu-1404-trusty-v20180814` `ubuntu-minimal-1804-bionic-v20180814` `ubuntu-minimal-1604-xenial-v20180814`	High	CVE-2018-5390 CVE-2018-5391

2018-09-05 Update

CVE-2018-5391 was disclosed on 2018-08-14 by US-CERT. As with CVE-2018-5390, this is a kernel-level networking vulnerability that increases the effectiveness of denial of service (DoS) attacks against vulnerable systems. The main difference is that CVE-2018-5391 is exploitable over IP connections. We updated this bulletin to cover both vulnerabilities.

Description

CVE-2018-5390 ("SegmentSmack") describes a kernel-level networking vulnerability that increases the effectiveness of denial of service (DoS) attacks against vulnerable systems over TCP connections.

CVE-2018-5391 ("FragmentSmack") describes a kernel-level networking vulnerability that increases the effectiveness of denial of service (DoS) attacks against vulnerable systems over IP connections.

Compute Engine impact

The host infrastructure that runs Compute Engine VMs is not at risk. The network infrastructure that handles traffic to and from Compute Engine VMs is protected against this vulnerability. Compute Engine VMs that only send/receive untrusted network traffic using HTTP(S), SSL, or TCP Load Balancers are protected against this vulnerability.

Compute Engine VMs running unpatched operating systems that send/receive untrusted network traffic directly, or using Network Load Balancers, are vulnerable to this DoS attack.

Consider updating your VM instances as soon as patches are available for their operating systems.

Compute Engine customers can update the guest operating systems on their instances using one of the following options:

Use patched public images to recreate existing VM instances. See the list of patched public images below.
On existing instances, install patches provided by the operating system vendor and reboot the patched instances.

Patched images and vendor resources

We will provide links to patch information from each operating system vendor here as they become available.

Project centos-cloud (CVE-2018-5390 only):
- centos-7-v20180815
- centos-6-v20180815
Project coreos-cloud (CVE-2018-5390 and CVE-2018-5391):
- coreos-stable-1800-7-0-v20180816
- coreos-beta-1855-2-0-v20180816
- coreos-alpha-1871-0-0-v20180816
Project cos-cloud (CVE-2018-5390 and CVE-2018-5391):
- cos-stable-65-10323-98-0
- cos-stable-66-10452-109-0
- cos-stable-67-10575-65-0
- cos-beta-68-10718-76-0
- cos-dev-69-10895-16-0
Project debian-cloud (CVE-2018-5390 and CVE-2018-5391):
- debian-9-stretch-v20180814
Project rhel-cloud (CVE-2018-5390 only):
- rhel-7-v20180814
- rhel-6-v20180814
Project suse-cloud (CVE-2018-5390 and CVE-2018-5391):
- sles-15-v20180816
- sles-12-sp3-v20180814
Project suse-sap-cloud (CVE-2018-5390 and CVE-2018-5391):
- sles-15-sap-v20180816
- sles-12-sp3-sap-v20180814
- sles-12-sp2-sap-v20180816
Project ubuntu-os-cloud (CVE-2018-5390 and CVE-2018-5391):
- ubuntu-1804-bionic-v20180814
- ubuntu-1604-xenial-v20180814
- ubuntu-1404-trusty-v20180814
- ubuntu-minimal-1804-bionic-v20180814
- ubuntu-minimal-1604-xenial-v20180814

High

Date published: 2018-01-03

last updated: 2018-05-21 T 15:00 PST

Description Severity Notes

Description	Severity	Notes
2018-05-21 Update CVE-2018-3640 and CVE-2018-3639, Variants 3a and 4 respectively, were disclosed by Intel. As with the first three variants of Spectre and Meltdown, the infrastructure that runs Compute Engine VM instances is protected and customer VM instances are isolated and protected from one another. Additionally, Compute Engine plans to deploy Intel's microcode patches to our infrastructure, which will allow customers who run untrusted or multi-tenant workloads within a single VM instance to enable additional intra-VM mitigations when those mitigations are provided by operating system vendors and providers. Compute Engine will deploy the microcode patches once Intel has certified them and after Compute Engine has tested and qualified the patches for our production environment. We will provide more detailed timelines and updates on this page as they become available. Description These CVEs are variants of a new class of attack that exploit the speculative execution technology available in many processors. This class of attack can allow for unauthorized read-only access to memory data under various circumstances. Compute Engine used VM Live Migration technology to perform host system and hypervisor updates with no user impact, no forced maintenance windows, and no mass reboots required. However, all guest operating systems and versions must be patched to protect against this new class of attack regardless of where those systems run. Read the Project Zero blog post for complete technical details on this attack method. Read the Google Security blog post for complete details on Google's mitigations including all product-specific information. Compute Engine impact The infrastructure that runs Compute Engine and isolates customer VM instances from each other is protected against known attacks. Our mitigations prevent unauthorized access to our host systems from applications running inside VM instances. These mitigations also prevent unauthorized access between VM instances running on the same host system. To prevent unauthorized access within your virtual machine instances, you must update the guest operating systems on those instances using one of the following options: Use patched public images to recreate your existing VM instances. See the list of patched public images below. On your existing instances, install patches provided by the operating system vendor for your distribution and reboot the patched instances. See the links to patch information from each operating system vendor below. Patched images and vendor resources Note: Patched images might not include fixes for all of the CVEs listed in this security bulletin notice. Additionally, different images might include different methods for preventing these types of attacks. Check with your operating system vendor to confirm which CVEs they address in their patches and what prevention methods they use. Project `cos-cloud`: Includes patches that prevent Variant 2 (CVE-2017-5715) and Variant 3 (CVE-2017-5754) attacks. Google used Retpoline in these images to mitigate Variant 2 attacks. `cos-stable-63-10032-71-0` or image family `cos-stable` Project `centos-cloud`: CentOS patch information `centos-7-v20180104` or image family `centos-7` `centos-6-v20180104` or image family `centos-6` Project `coreos-cloud`: CoreOS patch information `coreos-stable-1576-5-0-v20180105` or image family `coreos-stable` `coreos-beta-1632-1-0-v20180105` or image family `coreos-beta` `coreos-alpha-1649-0-0-v20180105` or image family `coreos-alpha` Project `debian-cloud`: Debian patch information `debian-9-stretch-v20180105` or image family `debian-9` `debian-8-jessie-v20180109` or image family `debian-8` Project `rhel-cloud`: RHEL patch information `rhel-7-v20180104` or image family `rhel-7` `rhel-6-v20180104` or image family `rhel-6` Project `suse-cloud`: SUSE patch information `sles-12-sp3-v20180104` or image family `sles-12` `sles-11-sp4-v20180104` or image family `sles-11` Project `suse-sap-cloud`: SUSE patch information `sles-12-sp3-sap-v20180104` or image family `sles-12-sp3-sap` `sles-12-sp2-sap-v20180104` or image family `sles-12-sp2-sap` Project `ubuntu-os-cloud`: Ubuntu patch information `ubuntu-1710-artful-v20180109` or image family `ubuntu-1710` `ubuntu-1604-xenial-v20180109` or image family `ubuntu-1604-lts` `ubuntu-1404-trusty-v20180110` or image family `ubuntu-1404-lts` Projects `windows-cloud` and `windows-sql-cloud`: All Windows Server and SQL Server public images with version number `-v20180109` and later include patches. However, you must follow the recommended actions provided by Microsoft in the Windows Server guidance support bulletin to enable and verify these mitigations on both your existing instances and newly-created instances. Use these images to recreate your VM instances. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks. Patches from hardware vendors NVIDIA provides patched drivers to mitigate potential attacks against systems that have NVIDIA® driver software installed. To learn which driver versions are patched, read the NVIDIA GPU Display Driver Security Updates security bulletin from NVIDIA. Revision history: 2018-05-21 T 14:00 PST: Added information about 2 new variants disclosed on May 21, 2018. 2018-01-10 T 15:00 PST: Added information about patched Windows Server and SQL Server public images. 2018-01-10 T 10:15 PST: Added several Ubuntu images to the list of patched public images. 2018-01-10 T 09:50 PST: Added guidance for patches from hardware vendors. 2018-01-03 to 2018-01-09: Made several revisions to the list of patched public images.	High	CVE-2017-5753 CVE-2017-5715 CVE-2017-5754 CVE-2018-3640 CVE-2018-3639

2018-05-21 Update

CVE-2018-3640 and CVE-2018-3639, Variants 3a and 4 respectively, were disclosed by Intel. As with the first three variants of Spectre and Meltdown, the infrastructure that runs Compute Engine VM instances is protected and customer VM instances are isolated and protected from one another. Additionally, Compute Engine plans to deploy Intel's microcode patches to our infrastructure, which will allow customers who run untrusted or multi-tenant workloads within a single VM instance to enable additional intra-VM mitigations when those mitigations are provided by operating system vendors and providers. Compute Engine will deploy the microcode patches once Intel has certified them and after Compute Engine has tested and qualified the patches for our production environment. We will provide more detailed timelines and updates on this page as they become available.

Description

These CVEs are variants of a new class of attack that exploit the speculative execution technology available in many processors. This class of attack can allow for unauthorized read-only access to memory data under various circumstances.

Compute Engine used VM Live Migration technology to perform host system and hypervisor updates with no user impact, no forced maintenance windows, and no mass reboots required. However, all guest operating systems and versions must be patched to protect against this new class of attack regardless of where those systems run.

Read the Project Zero blog post for complete technical details on this attack method. Read the Google Security blog post for complete details on Google's mitigations including all product-specific information.

Compute Engine impact

The infrastructure that runs Compute Engine and isolates customer VM instances from each other is protected against known attacks. Our mitigations prevent unauthorized access to our host systems from applications running inside VM instances. These mitigations also prevent unauthorized access between VM instances running on the same host system.

To prevent unauthorized access within your virtual machine instances, you must update the guest operating systems on those instances using one of the following options:

Use patched public images to recreate your existing VM instances. See the list of patched public images below.
On your existing instances, install patches provided by the operating system vendor for your distribution and reboot the patched instances. See the links to patch information from each operating system vendor below.

Patched images and vendor resources

Note: Patched images might not include fixes for all of the CVEs listed in this security bulletin notice. Additionally, different images might include different methods for preventing these types of attacks. Check with your operating system vendor to confirm which CVEs they address in their patches and what prevention methods they use.

Project cos-cloud: Includes patches that prevent Variant 2 (CVE-2017-5715) and Variant 3 (CVE-2017-5754) attacks. Google used Retpoline in these images to mitigate Variant 2 attacks.
- cos-stable-63-10032-71-0 or image family cos-stable
Project centos-cloud: CentOS patch information
- centos-7-v20180104 or image family centos-7
- centos-6-v20180104 or image family centos-6
Project coreos-cloud: CoreOS patch information
- coreos-stable-1576-5-0-v20180105 or image family coreos-stable
- coreos-beta-1632-1-0-v20180105 or image family coreos-beta
- coreos-alpha-1649-0-0-v20180105 or image family coreos-alpha
Project debian-cloud: Debian patch information
- debian-9-stretch-v20180105 or image family debian-9
- debian-8-jessie-v20180109 or image family debian-8
Project rhel-cloud: RHEL patch information
- rhel-7-v20180104 or image family rhel-7
- rhel-6-v20180104 or image family rhel-6
Project suse-cloud: SUSE patch information
- sles-12-sp3-v20180104 or image family sles-12
- sles-11-sp4-v20180104 or image family sles-11
Project suse-sap-cloud: SUSE patch information
- sles-12-sp3-sap-v20180104 or image family sles-12-sp3-sap
- sles-12-sp2-sap-v20180104 or image family sles-12-sp2-sap
Project ubuntu-os-cloud: Ubuntu patch information
- ubuntu-1710-artful-v20180109 or image family ubuntu-1710
- ubuntu-1604-xenial-v20180109 or image family ubuntu-1604-lts
- ubuntu-1404-trusty-v20180110 or image family ubuntu-1404-lts
Projects windows-cloud and windows-sql-cloud:
- All Windows Server and SQL Server public images with version number -v20180109 and later include patches. However, you must follow the recommended actions provided by Microsoft in the Windows Server guidance support bulletin to enable and verify these mitigations on both your existing instances and newly-created instances.

Use these images to recreate your VM instances. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks.

Patches from hardware vendors

NVIDIA provides patched drivers to mitigate potential attacks against systems that have NVIDIA® driver software installed. To learn which driver versions are patched, read the NVIDIA GPU Display Driver Security Updates security bulletin from NVIDIA.

Revision history:

2018-05-21 T 14:00 PST: Added information about 2 new variants disclosed on May 21, 2018.
2018-01-10 T 15:00 PST: Added information about patched Windows Server and SQL Server public images.
2018-01-10 T 10:15 PST: Added several Ubuntu images to the list of patched public images.
2018-01-10 T 09:50 PST: Added guidance for patches from hardware vendors.
2018-01-03 to 2018-01-09: Made several revisions to the list of patched public images.

High

Date published: 2017-10-02

Description	Severity	Notes
Dnsmasq provides functionality for serving DNS, DHCP, router advertisements, and network boot. This software is commonly installed in systems as varied as desktop Linux distributions (like Ubuntu), home routers, and IoT devices. Dnsmasq is widely used both on the open Internet and internally in private networks. Google discovered seven distinct issues over the course of our regular internal security assessments. After we determined the severity of these issues, we worked to investigate their impact and exploitability and then produced internal proofs of concept for each of them. We also worked with the maintainer of Dnsmasq, Simon Kelly, to produce appropriate patches and mitigate the issue. During our review, the team found three potential remote code executions, one information leak, and three denial of service vulnerabilities affecting the latest version at the project git server as of September 5th 2017. These patches are upstreamed and are committed to the project's Git repository. Compute Engine impact By default, Dnsmasq is only installed in images that use NetworkManager and is inactive by default. The following Compute Engine public images have Dnsmasq installed: Ubuntu 16.04, 16.10, 17.04 CentOS 7 RHEL 7 However, other images might have Dnsmasq installed as a dependency for other packages. We recommend that you update your Debian, Ubuntu, CentOS, RHEL, SLES, and OpenSuse instances to use the latest operating system image. CoreOS and Container-Optimized OS are not affected. Windows images are also unaffected. For instances running Debian and Ubuntu, you can perform an update by running the following commands in your instance: sudo apt-get -y update sudo apt-get -y dist-upgrade For Red Hat Enterprise Linux and CentOS instances, run: sudo yum -y upgrade For SLES and OpenSUSE images, run: sudo zypper up As an alternative to running the manual update commands, you can recreate VM instances using the image families of the respective operating system.	High	CVE-2017-14491 CVE-2017-14492 CVE-2017-14493 CVE-2017-14494 CVE-2017-14495 CVE-2017-14496 CVE-2017-13704

Description

Severity

Notes

Dnsmasq provides functionality for serving DNS, DHCP, router advertisements, and network boot. This software is commonly installed in systems as varied as desktop Linux distributions (like Ubuntu), home routers, and IoT devices. Dnsmasq is widely used both on the open Internet and internally in private networks.

Google discovered seven distinct issues over the course of our regular internal security assessments. After we determined the severity of these issues, we worked to investigate their impact and exploitability and then produced internal proofs of concept for each of them. We also worked with the maintainer of Dnsmasq, Simon Kelly, to produce appropriate patches and mitigate the issue.

During our review, the team found three potential remote code executions, one information leak, and three denial of service vulnerabilities affecting the latest version at the project git server as of September 5th 2017.

These patches are upstreamed and are committed to the project's Git repository.

Compute Engine impact

By default, Dnsmasq is only installed in images that use NetworkManager and is inactive by default. The following Compute Engine public images have Dnsmasq installed:

Ubuntu 16.04, 16.10, 17.04
CentOS 7
RHEL 7

However, other images might have Dnsmasq installed as a dependency for other packages. We recommend that you update your Debian, Ubuntu, CentOS, RHEL, SLES, and OpenSuse instances to use the latest operating system image. CoreOS and Container-Optimized OS are not affected. Windows images are also unaffected.

For instances running Debian and Ubuntu, you can perform an update by running the following commands in your instance:

sudo apt-get -y update

sudo apt-get -y dist-upgrade

For Red Hat Enterprise Linux and CentOS instances, run:

sudo yum -y upgrade

For SLES and OpenSUSE images, run:

sudo zypper up

As an alternative to running the manual update commands, you can recreate VM instances using the image families of the respective operating system.

High

Date published: 2016-10-26

Description Severity Notes

Description	Severity	Notes
CVE-2016-5195 is a race condition in the way Linux kernel's memory subsystem handled breakage of the read-only private mappings COW situation on write access. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. For more information see the Dirty COW FAQ. Compute Engine impact All Linux distributions and versions on Compute Engine are affected. Most instances will automatically download and install a newer kernel. However, a reboot is required to patch your running system. New or re-created instances based on the following Compute Engine images have patched kernels installed already. `centos-6-v20161026` `centos-7-v20161025` `coreos-alpha-1192-2-0-v20161021` `coreos-beta-1185-2-0-v20161021` `coreos-stable-1122-3-0-v20161021` `debian-8-jessie-v20161020` `rhel-6-v20161026` `rhel-7-v20161024` `sles-11-sp4-v20161021` `sles-12-sp1-v20161021` `ubuntu-1204-precise-v20161020` `ubuntu-1404-trusty-v20161020` `ubuntu-1604-xenial-v20161020` `ubuntu-1610-yakkety-v20161020`	High	CVE-2016-5195

CVE-2016-5195 is a race condition in the way Linux kernel's memory subsystem handled breakage of the read-only private mappings COW situation on write access.

An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system.

For more information see the Dirty COW FAQ.

Compute Engine impact

All Linux distributions and versions on Compute Engine are affected. Most instances will automatically download and install a newer kernel. However, a reboot is required to patch your running system.

New or re-created instances based on the following Compute Engine images have patched kernels installed already.

centos-6-v20161026
centos-7-v20161025
coreos-alpha-1192-2-0-v20161021
coreos-beta-1185-2-0-v20161021
coreos-stable-1122-3-0-v20161021
debian-8-jessie-v20161020
rhel-6-v20161026
rhel-7-v20161024
sles-11-sp4-v20161021
sles-12-sp1-v20161021
ubuntu-1204-precise-v20161020
ubuntu-1404-trusty-v20161020
ubuntu-1604-xenial-v20161020
ubuntu-1610-yakkety-v20161020

High

CVE-2016-5195

Date published: 2016-02-16

Last updated: 2016-02-22

Description Severity Notes

Description	Severity	Notes
CVE-2015-7547 is a vulnerability where the glibc DNS client side resolver makes software vulnerable to a stack-based buffer overflow when using the `getaddrinfo()` library function. An attacker can take advantage of software using the function to exploit this vulnerability with attacker-controlled domain names, attacker-controlled DNS servers, or through a man-in-the-middle attack. For more details, see the Google Security blog postor the Common Vulnerabilities and Exposures (CVE) database. Compute Engine impact Update (2016-02-22): You can now recreate your instances using the following CoreOS, SLES, and OpenSUSE images: `coreos-alpha-962-0-0-v20160218` `coreos-beta-899-7-0-v20160218` `coreos-stable-835-13-0-v20160218` `opensuse-13-2-v20160222` `opensuse-leap-42-1-v20160222` `sles-11-sp4-v20160222` `sles-12-sp1-v20160222` Update (2016-02-17): You can now perform an update on Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 15.10 instances by running the following commands: `user@my-instance:~$ sudo apt-get -y update` `user@my-instance:~$ sudo apt-get -y dist-upgrade` `user@my-instance:~$ sudo reboot` As an alternative to running the manual update commands, you can now recreate their instances with the following new images: `backports-debian-7-wheezy-v20160216` `centos-6-v20160216` `centos-7-v20160216` `debian-7-wheezy-v20160216` `debian-8-jessie-v20160216` `rhel-6-v20160216` `rhel-7-v20160216` `ubuntu-1204-precise-v20160217a` `ubuntu-1404-trusty-v20160217a` `ubuntu-1510-wily-v20160217` We are not aware of any methods that can exploit this vulnerability through Compute Engine's DNS resolvers with the default glibc configuration. We recommend you patch your virtual machine instances as soon as possible, since, as with any new vulnerability, new exploit methods might be discovered over time. If you have enabled edns0 (disabled by default), you should disable it until your instances are patched. Original bulletin: Your Linux distribution might be vulnerable. Compute Engine customers will need to update the OS images of their instances to eliminate this vulnerability if they are running a Linux OS. For instances running Debian, you can perform an update by running the following commands in your instance: `user@my-instance:~$ sudo apt-get -y update` `user@my-instance:~$ sudo apt-get -y dist-upgrade` `user@my-instance:~$ sudo reboot` We also recommend installing UnattendedUpgrades for your Debian instances. For Red Hat Enterprise Linux instances: `user@my-instance:~$ sudo yum -y upgrade` `user@my-instance:~$ sudo reboot` We will continue to update this bulletin as other operating system maintainers publish patches for this vulnerability and as Compute Engine releases updated OS images.	High	CVE-2015-7547

CVE-2015-7547 is a vulnerability where the glibc DNS client side resolver makes software vulnerable to a stack-based buffer overflow when using the getaddrinfo() library function. An attacker can take advantage of software using the function to exploit this vulnerability with attacker-controlled domain names, attacker-controlled DNS servers, or through a man-in-the-middle attack.

For more details, see the Google Security blog postor the Common Vulnerabilities and Exposures (CVE) database.

Compute Engine impact

Update (2016-02-22):

You can now recreate your instances using the following CoreOS, SLES, and OpenSUSE images:

coreos-alpha-962-0-0-v20160218
coreos-beta-899-7-0-v20160218
coreos-stable-835-13-0-v20160218
opensuse-13-2-v20160222
opensuse-leap-42-1-v20160222
sles-11-sp4-v20160222
sles-12-sp1-v20160222

Update (2016-02-17):

You can now perform an update on Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 15.10 instances by running the following commands:

user@my-instance:~$ sudo apt-get -y update
user@my-instance:~$ sudo apt-get -y dist-upgrade
user@my-instance:~$ sudo reboot

As an alternative to running the manual update commands, you can now recreate their instances with the following new images:

backports-debian-7-wheezy-v20160216
centos-6-v20160216
centos-7-v20160216
debian-7-wheezy-v20160216
debian-8-jessie-v20160216
rhel-6-v20160216
rhel-7-v20160216
ubuntu-1204-precise-v20160217a
ubuntu-1404-trusty-v20160217a
ubuntu-1510-wily-v20160217

We are not aware of any methods that can exploit this vulnerability through Compute Engine's DNS resolvers with the default glibc configuration. We recommend you patch your virtual machine instances as soon as possible, since, as with any new vulnerability, new exploit methods might be discovered over time. If you have enabled edns0 (disabled by default), you should disable it until your instances are patched.

Original bulletin:

Your Linux distribution might be vulnerable. Compute Engine customers will need to update the OS images of their instances to eliminate this vulnerability if they are running a Linux OS.

For instances running Debian, you can perform an update by running the following commands in your instance:

user@my-instance:~$ sudo apt-get -y update
user@my-instance:~$ sudo apt-get -y dist-upgrade
user@my-instance:~$ sudo reboot

We also recommend installing UnattendedUpgrades for your Debian instances.

For Red Hat Enterprise Linux instances:

user@my-instance:~$ sudo yum -y upgrade
user@my-instance:~$ sudo reboot

We will continue to update this bulletin as other operating system maintainers publish patches for this vulnerability and as Compute Engine releases updated OS images.

High

CVE-2015-7547

Date published: 2015-03-19

Description	Severity	Notes
CVE-2015-1427 is a vulnerability where the Groovy scripting engine in Elasticsearch before version 1.3.8 and any 1.4.x versions before 1.4.3, allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands. For more details, see the National Vulnerability Database (NVD) or the Common Vulnerabilities and Exposures (CVE) database. Compute Engine impact If you are running Elasticsearch on your Compute Engine instances, you should upgrade your Elasticsearch version to 1.4.3 or higher. If you have already upgraded your Elasticsearch software, you are protected from this vulnerability. If you have not upgraded Elasticsearch 1.4.3 or higher, you can perform a rolling upgrade. If you deployed Elasticsearch using Click-to-deploy in the Google Cloud console, you can delete the deployment to remove instances running Elasticsearch. The Google Cloud team is working on a fix in order to deploy an updated version of Elasticsearch. However, the fix is not yet available for the Click-to-deploy feature in the Google Cloud console .	High	CVE-2015-1427

Description

Severity

Notes

CVE-2015-1427 is a vulnerability where the Groovy scripting engine in Elasticsearch before version 1.3.8 and any 1.4.x versions before 1.4.3, allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.

For more details, see the National Vulnerability Database (NVD) or the Common Vulnerabilities and Exposures (CVE) database.

Compute Engine impact

If you are running Elasticsearch on your Compute Engine instances, you should upgrade your Elasticsearch version to 1.4.3 or higher. If you have already upgraded your Elasticsearch software, you are protected from this vulnerability.

If you have not upgraded Elasticsearch 1.4.3 or higher, you can perform a rolling upgrade.

If you deployed Elasticsearch using Click-to-deploy in the Google Cloud console, you can delete the deployment to remove instances running Elasticsearch.

The Google Cloud team is working on a fix in order to deploy an updated version of Elasticsearch. However, the fix is not yet available for the Click-to-deploy feature in the Google Cloud console .

High

CVE-2015-1427

Date published: 2015-01-29

Description Severity Notes

Description	Severity	Notes
CVE-2015-0235 (Ghost) is a vulnerability in the glibc library. App Engine, Cloud Storage, BigQuery, and Cloud SQL customers don't need to take any actions. Google servers have been updated and are protected from this vulnerability. Customers of Compute Engine may need to update their OS images. Compute Engine impact Your Linux distribution may be vulnerable. Compute Engine customers will need to update the OS images of their instances to eliminate this vulnerability if they are running Debian 7, Debian 7 backports, Ubuntu 12.04 LTS, Red Hat Enterprise Linux, CentOS, or SUSE Linux Enterprise Server 11 SP3. This vulnerability does not affect Ubuntu 14.04 LTS, Ubuntu 14.10, or SUSE Linux Enterprise Server 12. We recommend that you upgrade your Linux distributions. For instances running Debian 7, Debian 7 backports, or Ubuntu 12.04 LTS, you can perform an update by running the following commands in your instance: `user@my-instance:~$ sudo apt-get update` `user@my-instance:~$ sudo apt-get -y upgrade` `user@my-instance:~$ sudo reboot` For Red Hat Enterprise Linux or CentOS instances: `user@my-instance:~$ sudo yum -y upgrade` `user@my-instance:~$ sudo reboot` For SUSE Linux Enterprise Server 11 SP3 instances: `user@my-instance:~$ sudo zypper --non-interactive up` `user@my-instance:~$ sudo reboot` As an alternative to running the manual update commands above, users can now recreate their instances with the following new images: `debian-7-wheezy-v20150127` `backports-debian-7-wheezy-v20150127` `centos-6-v20150127` `centos-7-v20150127` `rhel-6-v20150127` `rhel-7-v20150127` `sles-11-sp3-v20150127` `ubuntu-1204-precise-v20150127` Google Managed VM impact Managed VM users using `gcloud preview app deploy` must update their base docker containers with `gcloud preview app setup-managed-vms` and redeploy each of their running apps using `gcloud preview app deploy`. Users that deploy with `appcfg` don't need to do anything and will be upgraded automatically.	High	CVE-2015-0235

CVE-2015-0235 (Ghost) is a vulnerability in the glibc library.

App Engine, Cloud Storage, BigQuery, and Cloud SQL customers don't need to take any actions. Google servers have been updated and are protected from this vulnerability.

Customers of Compute Engine may need to update their OS images.

Compute Engine impact

Your Linux distribution may be vulnerable. Compute Engine customers will need to update the OS images of their instances to eliminate this vulnerability if they are running Debian 7, Debian 7 backports, Ubuntu 12.04 LTS, Red Hat Enterprise Linux, CentOS, or SUSE Linux Enterprise Server 11 SP3.

This vulnerability does not affect Ubuntu 14.04 LTS, Ubuntu 14.10, or SUSE Linux Enterprise Server 12.

We recommend that you upgrade your Linux distributions. For instances running Debian 7, Debian 7 backports, or Ubuntu 12.04 LTS, you can perform an update by running the following commands in your instance:

user@my-instance:~$ sudo apt-get update
user@my-instance:~$ sudo apt-get -y upgrade
user@my-instance:~$ sudo reboot

For Red Hat Enterprise Linux or CentOS instances:

user@my-instance:~$ sudo yum -y upgrade
user@my-instance:~$ sudo reboot

For SUSE Linux Enterprise Server 11 SP3 instances:

user@my-instance:~$ sudo zypper --non-interactive up
user@my-instance:~$ sudo reboot

As an alternative to running the manual update commands above, users can now recreate their instances with the following new images:

debian-7-wheezy-v20150127
backports-debian-7-wheezy-v20150127
centos-6-v20150127
centos-7-v20150127
rhel-6-v20150127
rhel-7-v20150127
sles-11-sp3-v20150127
ubuntu-1204-precise-v20150127

Google Managed VM impact

Managed VM users using gcloud preview app deploy must update their base docker containers with gcloud preview app setup-managed-vms and redeploy each of their running apps using gcloud preview app deploy. Users that deploy with appcfg don't need to do anything and will be upgraded automatically.

High

CVE-2015-0235

Date published: 2014-10-15

Last updated: 2014-10-17

Description Severity Notes

Description	Severity	Notes
CVE-2014-3566 (aka POODLE) is a vulnerability in the design of SSL version 3.0. This vulnerability allows the plaintext of secure connections to be calculated by a network attacker. For details, see our blog post on the vulnerability. App Engine, Cloud Storage, BigQuery, and Cloud SQL customers don't need to take any actions. Google servers have been updated and are protected from this vulnerability. Customers of Compute Engine need to update their OS images. Compute Engine impact Updated (2014-10-17): You may be vulnerable if you are using SSLv3. Compute Engine customers will need to update the OS images of their instances to eliminate this vulnerability. We recommend that you upgrade your Linux distributions. For instances running Debian, you can perform an update by running the following commands in your instance: user@my-instance:~$ sudo apt-get update user@my-instance:~$ sudo apt-get -y upgrade user@my-instance:~$ sudo reboot For CentOS instances: user@my-instance:~$ sudo yum -y upgrade user@my-instance:~$ sudo reboot As an alternative to running the manual update commands above, users can now recreate their instances with the following new images to recreate your instances: `centos-6-v20141016` `centos-7-v20141016` `debian-7-wheezy-v20141017` `backports-debian-7-wheezy-v20141017` We will update the bulletin for RHEL and SLES images after we have the images. In the meantime, RHEL users can consult Red Hat directly for more information. Original bulletin: Compute Engine customers will need to update the OS images of their instances to eliminate this vulnerability. We will update this security bulletin with instructions once new OS images are available.	Medium	CVE-2014-3566

CVE-2014-3566 (aka POODLE) is a vulnerability in the design of SSL version 3.0. This vulnerability allows the plaintext of secure connections to be calculated by a network attacker. For details, see our blog post on the vulnerability.

App Engine, Cloud Storage, BigQuery, and Cloud SQL customers don't need to take any actions. Google servers have been updated and are protected from this vulnerability. Customers of Compute Engine need to update their OS images.

Compute Engine impact

Updated (2014-10-17):

You may be vulnerable if you are using SSLv3. Compute Engine customers will need to update the OS images of their instances to eliminate this vulnerability.

We recommend that you upgrade your Linux distributions. For instances running Debian, you can perform an update by running the following commands in your instance:

user@my-instance:~$ sudo apt-get update
user@my-instance:~$ sudo apt-get -y upgrade
user@my-instance:~$ sudo reboot

For CentOS instances:

user@my-instance:~$ sudo yum -y upgrade
user@my-instance:~$ sudo reboot

As an alternative to running the manual update commands above, users can now recreate their instances with the following new images to recreate your instances:

centos-6-v20141016
centos-7-v20141016
debian-7-wheezy-v20141017
backports-debian-7-wheezy-v20141017

We will update the bulletin for RHEL and SLES images after we have the images. In the meantime, RHEL users can consult Red Hat directly for more information.

Original bulletin:

Compute Engine customers will need to update the OS images of their instances to eliminate this vulnerability. We will update this security bulletin with instructions once new OS images are available.

Medium

CVE-2014-3566

Date published: 2014-09-24

last updated: 2014-09-29

Description Severity Notes

Description	Severity	Notes
There is a bug in bash (CVE-2014-6271) that allows remote code execution based on parsing of any attacker-controlled environment variables. The most likely vector of exploitation is using malicious HTTP requests made to CGI scripts exposed on a web server. For more information, see the bug description. The bash bugs have been mitigated for Google Cloud products except for Compute Engine guest OS images dated before 20140926. Please see below for steps to mitigate the bugs for your Compute Engine images. Compute Engine impact This bug may affect virtually all websites that use CGI scripts. In addition, it will likely affect web sites that rely on PHP, Perl, Python, SSI, Java, C++, and similar servlets that will ever invoke shell commands using calls such as `popen`, `system`, `shell_exec`, or similar APIs. It may also affect systems that attempt to allow controlled login access to restricted users using mechanisms such as SSH command limitation or the bash restricted shell. Update (2014-09-29): As an alternative to running the manual update commands below, users can now recreate their instances with images that mitigate additional vulnerabilities related to the bash security bug, including CVE-2014-7169, CVE-2014-6277, CVE-2014-6278, CVE-2014-7186, and CVE-2014-7187. Use the following new images to recreate your instances: `centos-6-v20140926` `centos-7-v20140926` `debian-7-wheezy-v20140926` `backports-debian-7-wheezy-v20140926` `rhel-6-v20140926` Update (2014-09-25): Users can now choose to recreate their instances instead of performing a manual update. To recreate your instances, use the following new images which contains fixes to this security bug: `backports-debian-7-wheezy-v20140924` `debian-7-wheezy-v20140924` `rhel-6-v20140924` `centos-6-v20140924` `centos-7-v20140924` For RHEL and SUSE images, you can also manually perform updates by running the following commands on your instances: # RHEL instances user@my-instance:~$ sudo yum -y upgrade # SUSE instances user@my-instance:~$ sudo zypper --non-interactive up Original bulletin: We recommend that you upgrade your Linux distributions. For instances running Debian, you can perform an update by running the following commands in your instance: user@my-instance:~$ sudo apt-get update user@my-instance:~$ sudo apt-get -y upgrade For CentOS instances: user@my-instance:~$ sudo yum -y upgrade For detailed information, review the announcement for the respective Linux distribution: Original patches: http://ftp.gnu.org/gnu/bash/ (see the last entry in *-patches for the appropriate version) Debian: [SECURITY] [DSA 3032-1] bash security update RHEL: RHSA-2014:1293-01 RHSA-2014:1294-01 CentOS 5: [CentOS-announce] CESA-2014:1293 CentOS 6: [CentOS-announce] CESA-2014:1293 CentOS 7: [CentOS-announce] CESA-2014:1293	High	CVE-2014-7169, CVE-2014-6271, CVE-2014-6277, CVE-2014-6278 CVE-2014-7186, CVE-2014-7187

There is a bug in bash (CVE-2014-6271) that allows remote code execution based on parsing of any attacker-controlled environment variables. The most likely vector of exploitation is using malicious HTTP requests made to CGI scripts exposed on a web server. For more information, see the bug description.

The bash bugs have been mitigated for Google Cloud products except for Compute Engine guest OS images dated before 20140926. Please see below for steps to mitigate the bugs for your Compute Engine images.

Compute Engine impact

This bug may affect virtually all websites that use CGI scripts. In addition, it will likely affect web sites that rely on PHP, Perl, Python, SSI, Java, C++, and similar servlets that will ever invoke shell commands using calls such as popen, system, shell_exec, or similar APIs. It may also affect systems that attempt to allow controlled login access to restricted users using mechanisms such as SSH command limitation or the bash restricted shell.

Update (2014-09-29):

As an alternative to running the manual update commands below, users can now recreate their instances with images that mitigate additional vulnerabilities related to the bash security bug, including CVE-2014-7169, CVE-2014-6277, CVE-2014-6278, CVE-2014-7186, and CVE-2014-7187. Use the following new images to recreate your instances:

centos-6-v20140926
centos-7-v20140926
debian-7-wheezy-v20140926
backports-debian-7-wheezy-v20140926
rhel-6-v20140926

Update (2014-09-25):

Users can now choose to recreate their instances instead of performing a manual update. To recreate your instances, use the following new images which contains fixes to this security bug:

backports-debian-7-wheezy-v20140924
debian-7-wheezy-v20140924
rhel-6-v20140924
centos-6-v20140924
centos-7-v20140924

For RHEL and SUSE images, you can also manually perform updates by running the following commands on your instances:

# RHEL instances
user@my-instance:~$ sudo yum -y upgrade

# SUSE instances
user@my-instance:~$ sudo zypper --non-interactive up

Original bulletin:

We recommend that you upgrade your Linux distributions. For instances running Debian, you can perform an update by running the following commands in your instance:

user@my-instance:~$ sudo apt-get update
user@my-instance:~$ sudo apt-get -y upgrade

For CentOS instances:

user@my-instance:~$ sudo yum -y upgrade

For detailed information, review the announcement for the respective Linux distribution:

Original patches: http://ftp.gnu.org/gnu/bash/ (see the last entry in *-patches for the appropriate version)
Debian: [SECURITY] [DSA 3032-1] bash security update
RHEL:
- RHSA-2014:1293-01
- RHSA-2014:1294-01
CentOS 5: [CentOS-announce] CESA-2014:1293
CentOS 6: [CentOS-announce] CESA-2014:1293
CentOS 7: [CentOS-announce] CESA-2014:1293

High

CVE-2014-7169, CVE-2014-6271, CVE-2014-6277, CVE-2014-6278 CVE-2014-7186, CVE-2014-7187

Date published: 2014-07-25

Description Severity Notes

Description	Severity	Notes
Elasticsearch Logstash is vulnerable to OS command injection that can allow unauthorized modification and disclosure of data. An attacker can send crafted events to any of Logstash's data sources, allowing the attacker to execute commands with the permissions of the Logstash process. Compute Engine impact This vulnerability affects all Compute Engine instances running versions of Elasticsearch Logstash before 1.4.2 with zabbix or nagios_nsca outputs enabled. To prevent attack, you can either: Upgrade to Logstash 1.4.2 Apply the patch for versions 1.3.x Disable the `zabbix` and `nagios_nsca` outputs. Read more on the Logstash blog. Elasticsearch also recommends using a firewall to prevent remote access by untrusted IPs.	High	CVE-2014-4326

Elasticsearch Logstash is vulnerable to OS command injection that can allow unauthorized modification and disclosure of data. An attacker can send crafted events to any of Logstash's data sources, allowing the attacker to execute commands with the permissions of the Logstash process.

Compute Engine impact

This vulnerability affects all Compute Engine instances running versions of Elasticsearch Logstash before 1.4.2 with zabbix or nagios_nsca outputs enabled. To prevent attack, you can either:

Upgrade to Logstash 1.4.2
Apply the patch for versions 1.3.x
Disable the zabbix and nagios_nsca outputs.

Date published: 2014-06-18

Description	Severity	Notes
We would like to take a moment to respond to any possible concerns that customers have about the security of Docker containers when running on Google Cloud. This includes customers using our App Engine extensions that support Docker Containers, container optimized virtual machines, or the Open Source Kubernetes scheduler. Docker has done a great job of responding to the issue and you can see their blog response here. Note that, as they say in their response, the issue revealed applies only to Docker 0.11, an older, pre-production, version. While the world is thinking about container security, we would like to point out that in Google Cloud, Linux application container based solutions (specifically Docker containers) run in full virtual machines (Compute Engine). While we support the efforts of the Docker community to harden the Linux application container stack, we recognize that the technology is new, and the surface area large. It is our belief that, for now, full hypervisors (virtual machines) provide a more compact and defensible surface area. Virtual machines were designed from the beginning to isolate malicious workloads and to minimize the likelihood and impact of a code bug. Our customers can rest assured that a full hypervisor boundary exists between them and any third party, potentially malicious code. Should we reach a point where we consider the Linux application container stack robust enough to support multi-tenant workloads, we will let the community know. For now, the Linux application container does not replace the virtual machine. It is a way to get a lot more out of it.	Low	Docker blog post

Description

Severity

Notes

We would like to take a moment to respond to any possible concerns that customers have about the security of Docker containers when running on Google Cloud. This includes customers using our App Engine extensions that support Docker Containers, container optimized virtual machines, or the Open Source Kubernetes scheduler.

Docker has done a great job of responding to the issue and you can see their blog response here. Note that, as they say in their response, the issue revealed applies only to Docker 0.11, an older, pre-production, version.

While the world is thinking about container security, we would like to point out that in Google Cloud, Linux application container based solutions (specifically Docker containers) run in full virtual machines (Compute Engine). While we support the efforts of the Docker community to harden the Linux application container stack, we recognize that the technology is new, and the surface area large. It is our belief that, for now, full hypervisors (virtual machines) provide a more compact and defensible surface area. Virtual machines were designed from the beginning to isolate malicious workloads and to minimize the likelihood and impact of a code bug.

Our customers can rest assured that a full hypervisor boundary exists between them and any third party, potentially malicious code. Should we reach a point where we consider the Linux application container stack robust enough to support multi-tenant workloads, we will let the community know. For now, the Linux application container does not replace the virtual machine. It is a way to get a lot more out of it.

Low

Docker blog post

Date published: 2014-06-05

Last updated: 2014-06-09

Description Severity Notes

Description	Severity	Notes
OpenSSL has an issue where the `ChangeCipherSpec` messages are not correctly bound into the handshake state machine. This allows them to be injected early into the handshake. An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a person-in-the-middle (PITM) attack where the attacker can decrypt and modify traffic from the attacked client and server. This issue is identified as CVE-2014-0224. The OpenSSL team has fixed the issue and alerted the OpenSSL community to update OpenSSL. Compute Engine impact This vulnerability affects all Compute Engine instances which use OpenSSL, including Debian, CentOS, Red Hat Enterprise Linux, and SUSE Linux Enterprise Server. You can update your instances by recreating them with new images, or by manually updating packages on your instances. Update (2014-06-09): To update your instances running SUSE Linux Enterprise Server with new images, recreate your instances using the following image versions or higher: `sles-11-sp3-v20140609` Original post: To update Debian and CentOS instances using new images, recreate your instances using any of the following image versions or higher: `debian-7-wheezy-v20140605` `backports-debian-7-wheezy-v20140605` `centos-6-v20140605` `rhel-6-v20140605` To manually update OpenSSL on your instances, run the following commands to update the appropriate packages. For instances running CentOS and RHEL, you can update OpenSSL by running these commands in your instance: user@my-instance:~$ sudo yum -y update user@my-instance:~$ sudo reboot For instances running Debian, you can update OpenSSL by running the following commands in your instance: user@my-instance:~$ sudo apt-get update user@my-instance:~$ sudo apt-get -y upgrade user@my-instance:~$ sudo reboot For instances running SUSE Linux Enterprise Server, you can ensure OpenSSL is up to date by running these commands in the instance: user@my-instance:~$ sudo zypper --non-interactive up user@my-instance:~$ sudo reboot	Medium	CVE-2014-0224

OpenSSL has an issue where the ChangeCipherSpec messages are not correctly bound into the handshake state machine. This allows them to be injected early into the handshake. An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a person-in-the-middle (PITM) attack where the attacker can decrypt and modify traffic from the attacked client and server.

This issue is identified as CVE-2014-0224. The OpenSSL team has fixed the issue and alerted the OpenSSL community to update OpenSSL.

Compute Engine impact

This vulnerability affects all Compute Engine instances which use OpenSSL, including Debian, CentOS, Red Hat Enterprise Linux, and SUSE Linux Enterprise Server. You can update your instances by recreating them with new images, or by manually updating packages on your instances.

Update (2014-06-09): To update your instances running SUSE Linux Enterprise Server with new images, recreate your instances using the following image versions or higher:

sles-11-sp3-v20140609

Original post:

To update Debian and CentOS instances using new images, recreate your instances using any of the following image versions or higher:

debian-7-wheezy-v20140605
backports-debian-7-wheezy-v20140605
centos-6-v20140605
rhel-6-v20140605

To manually update OpenSSL on your instances, run the following commands to update the appropriate packages. For instances running CentOS and RHEL, you can update OpenSSL by running these commands in your instance:

user@my-instance:~$ sudo yum -y update
user@my-instance:~$ sudo reboot

For instances running Debian, you can update OpenSSL by running the following commands in your instance:

user@my-instance:~$ sudo apt-get update
user@my-instance:~$ sudo apt-get -y upgrade
user@my-instance:~$ sudo reboot

For instances running SUSE Linux Enterprise Server, you can ensure OpenSSL is up to date by running these commands in the instance:

user@my-instance:~$ sudo zypper --non-interactive up
user@my-instance:~$ sudo reboot

Medium

CVE-2014-0224

Date published: 2014-04-08

Description Severity Notes

Description	Severity	Notes
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g don't properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory using crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to `d1_both.c` and `t1_lib.c`, also known as the Heartbleed bug. Compute Engine impact This vulnerability affects all Compute Engine Debian, RHEL, and CentOS instances that don't have the most updated version of OpenSSL. You can update your instances by recreating them with new images, or by manually updating packages on your instances. To update your instances using new images, recreate your instances using any of the following image versions or higher: `debian-7-wheezy-v20140408` `backports-debian-7-wheezy-v20140408` `centos-6-v20140408` `rhel-6-v20140408` To manually update OpenSSL on your instances, run the following commands to update the appropriate packages. For instances running CentOS and RHEL, you can ensure OpenSSL is up to date by running these commands in the instance: user@my-instance:~$ sudo yum update user@my-instance:~$ sudo reboot For instances running Debian, you can update OpenSSL by running the following commands in your instance: user@my-instance:~$ sudo apt-get update user@my-instance:~$ sudo apt-get upgrade user@my-instance:~$ sudo reboot Instances running SUSE Linux are not affected. Update on April 14, 2014: In light of new research on extracting keys using the Heartbleed bug, Compute Engine is recommending that Compute Engine customers create new keys for any affected SSL services.	Medium	CVE-2014-0160

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g don't properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory using crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, also known as the Heartbleed bug.

Compute Engine impact

This vulnerability affects all Compute Engine Debian, RHEL, and CentOS instances that don't have the most updated version of OpenSSL. You can update your instances by recreating them with new images, or by manually updating packages on your instances.

To update your instances using new images, recreate your instances using any of the following image versions or higher:

debian-7-wheezy-v20140408
backports-debian-7-wheezy-v20140408
centos-6-v20140408
rhel-6-v20140408

To manually update OpenSSL on your instances, run the following commands to update the appropriate packages. For instances running CentOS and RHEL, you can ensure OpenSSL is up to date by running these commands in the instance:

user@my-instance:~$ sudo yum update
user@my-instance:~$ sudo reboot

For instances running Debian, you can update OpenSSL by running the following commands in your instance:

user@my-instance:~$ sudo apt-get update
user@my-instance:~$ sudo apt-get upgrade
user@my-instance:~$ sudo reboot

Instances running SUSE Linux are not affected.

Update on April 14, 2014: In light of new research on extracting keys using the Heartbleed bug, Compute Engine is recommending that Compute Engine customers create new keys for any affected SSL services.

Medium

CVE-2014-0160

Date published: 2013-06-07

Description Severity Notes

Description	Severity	Notes
Note: This vulnerability is only applicable for kernels, which have been deprecated and removed since API version v1. Format string vulnerability in the `b43_request_firmware` function in `drivers/net/wireless/b43/main.c` in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an `fwpostfix` modprobe parameter, leading to improper construction of an error message. Compute Engine impact This vulnerability affects all Compute Engine kernels earlier than `gcg-3.3.8-201305291443`. In response, Compute Engine has deprecated all earlier kernels and recommends that users update their instances and images to use Compute Engine kernel `gce-v20130603`. `gce-v20130603` contains kernel `gcg-3.3.8-201305291443`, which has the patch for this vulnerability. To find out what kernel version your instance is using: Connect to your instance using ssh Run `uname -r`	Medium	CVE-2013-2852

Note: This vulnerability is only applicable for kernels, which have been deprecated and removed since API version v1.

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message.

Compute Engine impact

This vulnerability affects all Compute Engine kernels earlier than gcg-3.3.8-201305291443. In response, Compute Engine has deprecated all earlier kernels and recommends that users update their instances and images to use Compute Engine kernel gce-v20130603. gce-v20130603 contains kernel gcg-3.3.8-201305291443, which has the patch for this vulnerability.

To find out what kernel version your instance is using:

Connect to your instance using ssh
Run uname -r

Medium

CVE-2013-2852

Date published: 2013-06-07

Description Severity Notes

Description	Severity	Notes
Note: This vulnerability is only applicable for kernels, which have been deprecated and removed since API version v1. Format string vulnerability in the register_disk function in `block/genhd.c` in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to `/sys/module/md_mod/parameters/new_array` in order to create a crafted `/dev/md` device name. Compute Engine Impact This vulnerability affects all Compute Engine kernels earlier than `gcg-3.3.8-201305291443`. In response, Compute Engine has deprecated all earlier kernels and recommends that users update their instances and images to use Compute Engine kernel `gce-v20130603`. `gce-v20130603` contains kernel `gcg-3.3.8-201305291443`, which has the patch for this vulnerability. To find out what kernel version your instance is using: Connect to your instance using ssh Run `uname -r`	Medium	CVE-2013-2851

Note: This vulnerability is only applicable for kernels, which have been deprecated and removed since API version v1.

Format string vulnerability in the register_disk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/md_mod/parameters/new_array in order to create a crafted /dev/md device name.

Compute Engine Impact

To find out what kernel version your instance is using:

Connect to your instance using ssh
Run uname -r

Medium

CVE-2013-2851

Date published: 2013-05-14

Description Severity Notes

Description	Severity	Notes
Note: This vulnerability is only applicable for kernels, which have been deprecated and removed since API version v1. The perf_swevent_init function in `kernel/events/core.c` in the Linux kernel before 3.8.9 uses an incorrect `integer` data type, which allows local users to gain privileges using a crafted `perf_event_open` system call. Compute Engine impact This vulnerability affects all Compute Engine kernels earlier than `gcg-3.3.8-201305211623`. In response, Compute Engine has deprecated all earlier kernels and recommends that users update their instances and images to use Compute Engine kernel `gce-v20130521`. `gce-v20130521` contains kernel `gcg-3.3.8-201305211623`, which has the patch for this vulnerability. To find out what kernel version your instance is using: Connect to your instance using ssh Run `uname -r`	High	CVE-2013-2094

Note: This vulnerability is only applicable for kernels, which have been deprecated and removed since API version v1.

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges using a crafted perf_event_open system call.

Compute Engine impact

This vulnerability affects all Compute Engine kernels earlier than gcg-3.3.8-201305211623. In response, Compute Engine has deprecated all earlier kernels and recommends that users update their instances and images to use Compute Engine kernel gce-v20130521. gce-v20130521 contains kernel gcg-3.3.8-201305211623, which has the patch for this vulnerability.

To find out what kernel version your instance is using:

Connect to your instance using ssh
Run uname -r

High

CVE-2013-2094

Date published: 2013-02-18

Description Severity Notes

Description	Severity	Notes
Note: This vulnerability is only applicable for kernels, which have been deprecated and removed since API version v1. Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges using a `PTRACE_SETREGS ptrace` system call in a crafted application. Compute Engine impact This vulnerability affects Compute Engine kernels `2.6.x-gcg-<date>`. In response, Compute Engine has deprecated 2.6.x kernels and recommends that users update their instances and images to use Compute Engine kernel `gce-v20130225`. `gce-v20130225` contains kernel `3.3.8-gcg-201302081521`, which has the patch for this vulnerability. To find out what kernel version your instance is using: Connect to your instance using ssh Run `uname -r`	Medium	CVE-2013-0871

Note: This vulnerability is only applicable for kernels, which have been deprecated and removed since API version v1.

Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges using a PTRACE_SETREGS ptrace system call in a crafted application.

Compute Engine impact

This vulnerability affects Compute Engine kernels 2.6.x-gcg-<date>. In response, Compute Engine has deprecated 2.6.x kernels and recommends that users update their instances and images to use Compute Engine kernel gce-v20130225. gce-v20130225 contains kernel 3.3.8-gcg-201302081521, which has the patch for this vulnerability.

To find out what kernel version your instance is using:

Connect to your instance using ssh
Run uname -r

Medium

CVE-2013-0871