Heads-up: update intel-microcode on Xeon E5v2/E7v2 servers
If you have a server or workstation with Intel Xeon E5v2 or E7v2 processors,
you may need updated processor microcode to avoid erratum CA131/CF124:
CA135/CF124 Incorrect Page Translation when EPT is enabled
Problem: If EPT (Extended Page Tables) is enabled, then a complex
sequence of internal processor events may result in unexpected
page faults or use of incorrect page translations.
Implication: Due to this erratum a guest may crash or experience
unpredictable system behavior. It is possible for the BIOS to
contain a workaround for this erratum.
Make no mistake: this is a *critical* fix, and you should apply it
post-haste if you haven't done so already to any boxes with Intel Xeon E5v2
and Intel Xeon E7v2 processors. Incorrect page translations are extremely
dangerous.
Please make sure you have the latest intel-microcode package installed, and
check with your system vendor for a BIOS/EFI update.
Updated intel-microcode packages (with Intel microcode release 20140430) for
stable-backports, testing and unstable have been available for a while,
already.
A stable update for intel-microcode is already available at
wheezy-proposed-updates, and will be included in the next Wheezy stable
point release.
Squeeze LTS users will have to wait for the updated intel-microcode package
to clear the squeeze-backports policy queue, and that might well happen only
after the next stable point-release is out.
If anyone is wondering why this notice is showing up so late, and why such
an important microcode update was uploaded at low priority: Debian does not
have access to Intel partner channels, so we never get any warnings about
microcode updates. The uploads were already done (including the one for
stable and squeeze-backports) when I came across information about the
microcode update including a fix for erratum CA131.
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh
Reply to: