2024-08-20: Include patches for TPUs. Apply updates from Linux distributions as they become available. Please refer to guidance from Linux distributions. If you are using TPUs, please update to one of the following patched versions:

• tpu-ubuntu2204-base
• v2-alpha-tpuv5
• v2-alpha-tpuv5-lite

A vulnerability (CVE-2024-6387) has been discovered in OpenSSH. Successful exploitation of this vulnerability allows a remote, unauthenticated attacker to execute arbitrary code as root on the target machine.

All Compute Engine VMs that use a glibc-based Linux distribution and have OpenSSH exposed are recommended to be analyzed for the vulnerable versions.

What should I do?

1. Apply updates from Linux distributions as they become available. Please refer to guidance from Linux distributions. For Google's Container-Optimized OS, please update to one of the following patched versions:
   • cos-113-18244-85-49
   • cos-109-17800-218-69
   • cos-105-17412-370-67
   • cos-101-17162-463-55
   If you are using Container-Optimized OS through a Google managed service (e.g. GKE), please refer to that service's security bulletin for patch availability.
2. If updating is not possible, consider turning OpenSSH off until it can be patched. The default network is pre-populated with a default-allow-ssh firewall rule to allow ssh access from the public Internet. To remove this access, customers can:
   1. Optionally create rules to allow any SSH access you need from trusted networks to GKE nodes or other Compute Engine VMs in the project; then
   2. Disable the default firewall rule with the following command:

      gcloud compute firewall-rules update default-allow-ssh --disabled --project=$PROJECT
            

   If you have created any other firewall rules that may allow SSH through TCP on port 22, disable them, or limit the source IPs to trusted networks.
   
   Verify that you can no longer ssh to your VMs from the Internet. This firewall configuration mitigates the vulnerability.
3. If OpenSSH needs to be left on, you can also execute a configuration update which eliminates the race case condition for the exploit. This is a runtime mitigation. To apply the changes in the sshd config, this script will restart the sshd service.

   #!/bin/bash
   set -e
   
   SSHD_CONFIG_FILE=/etc/ssh/sshd_config
   # -c: count the matches
   # -q: don't print to console
   # -i: sshd_config keywords are case insensitive.
   if [[ "$(grep -ci '^LoginGraceTime' $SSHD_CONFIG_FILE)" -eq 0 ]]; then
       echo "LoginGraceTime 0" >> "$SSHD_CONFIG_FILE"
       echo "Set the LoginGraceTime to 0 in $SSHD_CONFIG_FILE"
   else
       sed -i 's/^LoginGraceTime.*$/LoginGraceTime 0/' /etc/ssh/sshd_config
       echo "Changed the LoginGraceTime to 0 in $SSHD_CONFIG_FILE"
   fi
   # Restart the sshd service to apply the new config.
   systemctl restart sshd
       

4. Finally, monitor for any unusual network activity involving SSH servers.

Compute Engine is not affected by CVE-2024-3094, which affects versions 5.6.0 and 5.6.1 of the xz-utils package in the liblzma library, and could lead to compromise of the OpenSSH utility.

What should I do?

Public images supported and offered by Compute Engine are not affected by this CVE. If you use Compute Engine public images for your VMs, no action is required.

You could be at risk if you created a custom image that used versions 5.6.0 and 5.6.1 of xz-utils package, such as the following operating systems:

• Fedora 41 and Fedora Rawhide
• Debian testing/unstable
• openSUSE tumbleweed

To mitigate this risk, stop any VMs that use these operating systems or others that could have used affected operating systems. If you have VMs built from custom images of other operating systems, check with your OS vendor to see if your VMs are affected.

What vulnerabilities are being addressed?

CVE-2024-3094

Several vulnerabilities were discovered in the TianoCore EDK II UEFI firmware. This firmware is used in Google Compute Engine VMs. If exploited, the vulnerabilities could allow a bypass of secure boot, which would provide false measurements in the secure boot process, including when used in Shielded VMs.

What should I do?

No action is required. Google has patched this vulnerability across Compute Engine and all VMs are protected from this vulnerability.

What vulnerabilities are addressed by this patch?

The patch mitigated the following vulnerabilities:

• CVE-2022-36763
• CVE-2022-36764
• CVE-2022-36765

• CVE-2022-36763
• CVE-2022-36764
• CVE-2022-36765

On November 14, AMD disclosed multiple vulnerabilities that impact various AMD server CPUs. Specifically, the vulnerabilities impact EPYC Server CPUs leveraging Zen core generation 2 "Rome," gen 3 "Milan," and gen 4 "Genoa."

Google has applied fixes to affected assets, including Google Cloud, to ensure customers are protected. At this time, no evidence of exploitation has been found or reported to Google.

What should I do?

No customer action is required.

Fixes have already been applied to the Google server fleet for Google Cloud, including Google Compute Engine.

What vulnerabilities are addressed by this patch?

The patch mitigated the following vulnerabilities:

• CVE-2022-23820
• CVE-2021-46774
• CVE-2023-20533
• CVE-2023-20519
• CVE-2023-20592
• CVE-2023-20566
• CVE-2023-20521
• CVE-2021-46766
• CVE-2022-23830
• CVE-2023-20526
• CVE-2021-26345

For more information, see AMD's security advisory AMD-SN-3005: "AMD INVD Instruction Security Notice", also published as CacheWarp, and AMD-SN-3002: "AMD Server Vulnerabilities – November 2023".

• CVE-2022-23820
• CVE-2021-46774
• CVE-2023-20533
• CVE-2023-20519
• CVE-2023-20592
• CVE-2023-20566
• CVE-2022-23830
• CVE-2023-20526
• CVE-2021-26345

Two vulnerabilities (CVE-2023-1017 and CVE-2023-1018) were discovered in Trusted Platform Module (TPM) 2.0.

The vulnerabilities could have allowed a sophisticated attacker to exploit a 2-byte out of bounds read/write on certain Compute Engine VMs.

What should I do?

A patch was automatically applied to all vulnerable VMs. No customer action is required.

What vulnerabilities are addressed by this patch?

The patch mitigated the following vulnerabilities:

CVE-2023-1017

With CVE-2023-2017, a buffer overrun could be triggered in the vTPM parameter decryption routine. A local attacker running on a vulnerable VM could use this to trigger a denial-of-service or possibly execute arbitrary code in the vTPM context.

CVE-2023-1018

With CVE-2023-2018, an out-of-bounds read existed in the vTPM parameter decryption routine. A local attacker running on a vulnerable VM could use this to indirectly leak limited data from the vTPM context.

• CVE-2023-1017
• CVE-2023-1018

The Apache Log4j utility is a commonly used component for logging requests. On December 9, 2021, a vulnerability was reported that could allow a system running Apache Log4j version 2.14.1 or below to be compromised and allow an attacker to execute arbitrary code.

On December 10, 2021, NIST published a critical Common Vulnerabilities and Exposure alert, CVE-2021-44228. More specifically, Java Naming Directory Interface (JNDI) features used in configuration, log messages, and parameters don't protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from remote servers when message lookup substitution is enabled.

What should I do?

• M4CE v4.x: The Migrate for Compute Engine (M4CE) Team has provided a new version on 13 December, 2021. Project managers are required to replace the existing deployment with the new version including in-cloud M4CE Manager and M4CE "on premises" backend. See the How to Guide for details on version 4.11 deploy details.
• M2VMs v5.x: M2VMs v5.0 and above has been fixed and no action is required.

• CVE-2021-44228

A vulnerability was recently discovered in the Linux utility sudo, described in CVE-2021-3156, that might allow an attacker with unprivileged local shell access on a system with sudo installed to escalate their privileges to root on the system.

Compute Engine impact

The underlying infrastructure that runs Compute Engine is not impacted by this vulnerability. Compute Engine VMs running Linux should consider updating their guest operating system. For example, if you use a Container-Optimized OS, we recommend you update to one of the following images: cos-85-13310-1209-7, cos-81-12871-1245-6, cos-dev-89-16091-0-0, or later.

• CVE-2021-3156

Netflix has recently disclosed three TCP vulnerabilities in Linux kernels:

• CVE-2019-11477
• CVE-2019-11478
• CVE-2019-11479

These CVEs are collectively referred to as NFLX-2019-001.

Compute Engine impact

The infrastructure that hosts Compute Engine is protected from this vulnerability.

Compute Engine VMs running unpatched Linux operating systems that send/receive untrusted network traffic are vulnerable to this DoS attack. Consider updating these VM instances as soon as patches are available for their operating systems.

Load balancers that close TCP connections have been patched against this vulnerability. Compute Engine instances that receive only untrusted traffic through these load balancers are not vulnerable. This includes HTTP Load Balancers, SSL Proxy Load Balancers, and TCP Proxy Load Balancers.

Network load balancers and internal load balancers don't close TCP connections. Unpatched Compute Engine instances that receive untrusted traffic through these load balancers are vulnerable.

Patched images and vendor resources

We will provide links to patch information from each operating system vendor here as they become available, including the status for each CVE. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks:

• Project debian-cloud:
  • debian-9-stretch-v20190618
• Project centos-cloud:
  • centos-6-v20190619
  • centos-7-v20190619
• Project cos-cloud:
  • cos-dev-77-12293-0-0
  • cos-beta-76-12239-21-0
  • cos-stable-75-12105-77-0
  • cos-73-11647-217-0
  • cos-69-10895-277-0
• Project coreos-cloud:
  • coreos-alpha-2163-2-1-v20190617
  • coreos-beta-2135-3-1-v20190617
  • coreos-stable-2079-6-0-v20190617
• Project rhel-cloud:
  • rhel-6-v20190618
  • rhel-7-v20190618
  • rhel-8-v20190618
• Project rhel-sap-cloud:
  • rhel-7-4-sap-v20190618
  • rhel-7-6-sap-v20190618
• Project suse-cloud:
  • sles-12-sp4-v20190617
  • sles-15-v20190617
• Project suse-sap-cloud:
  • sles-12-sp1-sap-v20190617
  • sles-12-sp2-sap-v20190617
  • sles-12-sp3-sap-v20190617
  • sles-12-sp4-sap-v20190617
  • sles-15-sap-v20190617
• Project ubuntu-cloud:
  • ubuntu-1604-xenial-v20190617
  • ubuntu-1804-bionic-v20190617
  • ubuntu-1810-cosmic-v20190618
  • ubuntu-1904-disco-v20190619
  • ubuntu-minimal-1604-xenial-v20190618
  • ubuntu-minimal-1804-bionic-v20190617
  • ubuntu-minimal-1810-cosmic-v20190618
  • ubuntu-minimal-1904-disco-v20190618

• CVE-2019-11477
• CVE-2019-11478
• CVE-2019-11479

Intel has disclosed the following CVEs:

• CVE-2018-12126
• CVE-2018-12127
• CVE-2018-12130
• CVE-2019-11091

These CVEs are collectively referred to as Microarchitectural Data Sampling (MDS). These vulnerabilities potentially allow data to be exposed using the interaction of speculative execution with microarchitectural state.

Compute Engine impact

The host infrastructure that runs Compute Engine isolates customer workloads from each other. Unless you are running untrusted code inside your VMs, no further action is required.

For customers running untrusted code in their own multi-tenant services within Compute Engine virtual machines, refer to your Guest OS Vendor's recommended mitigation, which might include using Intel's microcode mitigation features. We have deployed guest pass-through access to the new flush functionality. The following is a summary of mitigation steps available for common guest images.

Patched images and vendor resources

We will provide links to patch information from each operating system vendor here as they become available, including status for each CVE. Use these images to recreate VM instances. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks:

• Project centos-cloud: CESA-2019:1169, CESA-2019:1168
• centos-6-v20190515
• centos-7-v20190515
• Project coreos-cloud: MDS mitigations for CoreOS Container Linux
• coreos-stable-2079-4-0-v20190515
• coreos-beta-2107-3-0-v20190515
• coreos-alpha-2135-1-0-v20190515
• Project cos-cloud
• cos-69-10895-242-0
• cos-73-11647-182-0
• Project debian-cloud: DSA-4444
• debian-9-stretch-v20190514
• Project rhel-cloud: Red Hat MDS Knowledge Article
• rhel-6-v20190515
• rhel-7-v20190517
• rhel-8-v20190515
• Project rhel-sap-cloud: Red Hat MDS Knowledge Article
• rhel-7-4-sap-v20190515
• rhel-7-6-sap-v20190517
• Project suse-cloud: SUSE MDS KB
• sles-12-sp4-v20190520
• sles-15-v20190520
• Project suse-sap-cloud
• sles-12-sp4-sap-v20190520
• sles-15-sap-v20190520
• Project ubuntu-os-cloud: Ubuntu MDS Wiki
• ubuntu-1404-trusty-v20190514
• ubuntu-1604-xenial-v20190514
• ubuntu-1804-bionic-v20190514
• ubuntu-1810-cosmic-v20190514
• ubuntu-1904-disco-v20190514
• ubuntu-minimal-1604-xenial-v20190514
• ubuntu-minimal-1804-bionic-v20190514
• ubuntu-minimal-1810-cosmic-v20190514
• ubuntu-minimal-1904-disco-v20190514
• Projects windows-cloud and windows-sql-cloud: Microsoft ADV190013
• All Windows Server and SQL Server public images with version number v20190514.
• Project gce-uefi-images
• centos-7-v20190515
• cos-69-10895-242-0
• cos-73-11647-182-0
• rhel-7-v20190517
• ubuntu-1804-bionic-v20190514
• All Windows Server public images with version number v20190514.

Container-Optimized OS

If you are using Container Optimized OS (COS) as your Guest OS and you are running untrusted, multi-tenant workloads in your virtual machine, we recommend that you:

1. Disable Hyper-Threading by setting nosmt on the kernel command-line.
   

   On existing COS VMs, you can modify the grub.cfg as follows to set the nosmt option and then reboot the system:

   # Run as root:
   dir="$(mktemp -d)"
   mount /dev/sda12 "${dir}"
   sed -i -e "s|cros_efi|cros_efi nosmt|g" "${dir}/efi/boot/grub.cfg"
   umount "${dir}"
   rmdir "${dir}"
   
   reboot

   For convenience, you can run the script below to achieve the same result as running the commands earlier. We recommend making this script part of your cloud-config, startup scripts or instance templates, to ensure that new VMs use this new parameter. An example cloud-config that runs this script is below.

   Warning: This command will result in an immediate reboot of the instance when run for the first time. Subsequent runs of the command on an instance with Hyper-Threading already disabled will have no effect.

   # Run as root
   /bin/bash <(curl -s https://storage.googleapis.com/cos-tools/scripts/disable_smt.sh)
   

   To include this as part of your cloud-config:

   #cloud-config
   
   bootcmd:
   - /bin/bash -c "/bin/bash <(curl -s https://storage.googleapis.com/cos-tools/scripts/disable_smt.sh)"
   

   To confirm if Hyper-Threading is disabled on your instance, look at the output of /sys/devices/system/cpu/smt/active and /sys/devices/system/cpu/smt/control files. If it returns 0 for active and off for control, Hyper-Threading is disabled:

   cat /sys/devices/system/cpu/smt/active
   cat /sys/devices/system/cpu/smt/control
   

   Note: If you have enabled UEFI Secure Boot on your instance, you will need to re-create your instance with UEFI Secure Boot disabled, run the above command with UEFI Secure Boot disabled, and then enable UEFI Secure Boot on your new instance.

2. Use new version of COS image
   

   In addition to disabling Hyper-Threading as described above, you should also re-create your instances with the updated images listed above or newer versions (when available) of Container-Optimized OS images to get fully protected from the vulnerability.

• CVE-2018-12126
• CVE-2018-12127
• CVE-2018-12130
• CVE-2019-11091

Description

Intel has disclosed the following CVEs:

• CVE-2018-3615 (for SGX)
• CVE-2018-3620 (for operating systems and SMT)
• CVE-2018-3646 (for virtualization)

These CVEs are collectively referred to as "L1 Terminal Fault (L1TF)".

These L1TF vulnerabilities exploit speculative execution by attacking the configuration of processor-level data structures. "L1" refers to the Level-1 Data cache (L1D), a small on-core resource used to accelerate memory access.

Read the Google Cloud blog post for more details on these vulnerabilities and Compute Engine's mitigations.

Compute Engine impact

The host infrastructure that runs Compute Engine and isolates customer workloads from each other is protected against known attacks.

Compute Engine customers are encouraged to update their images to prevent the possibility of indirect exploitation within their guest environments. This is particularly important for customers running their own multi-tenant services on Compute Engine virtual machines.

Compute Engine customers can update the guest operating systems on their instances using one of the following options:

• Use patched public images to recreate existing VM instances.
• On existing instances, install patches provided by the operating system vendor and reboot the patched instances.

Patched images and vendor resources

We will provide links to patch information from each operating system vendor here as they become available, including status for both CVEs. Use these images to recreate VM instances. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks:

• Project centos-cloud:
  • centos-7-v20180815
  • centos-6-v20180815
• Project coreos-cloud:
  • coreos-stable-1800-7-0-v20180816
  • coreos-beta-1855-2-0-v20180816
  • coreos-alpha-1871-0-0-v20180816
• Project cos-cloud:
  • cos-stable-66-10452-110-0
  • cos-stable-67-10575-66-0
  • cos-beta-68-10718-81-0
  • cos-dev-69-10895-23-0
• Project debian-cloud:
  • debian-9-stretch-v20180820
• Project rhel-cloud:
  • rhel-7-v20180814
  • rhel-6-v20180814
• Project rhel-sap-cloud:
  • rhel-7-sap-apps-v20180814
  • rhel-7-sap-hana-v20180814
• Project suse-cloud:
  • sles-15-v20180816
  • sles-12-sp3-v20180814
  • sles-11-sp4-v20180816
• Project suse-sap-cloud:
  • sles-15-sap-v20180816
  • sles-12-sp3-sap-v20180814
  • sles-12-sp2-sap-v20180816
• Project ubuntu-os-cloud:
  • ubuntu-1804-bionic-v20180814
  • ubuntu-1604-xenial-v20180814
  • ubuntu-1404-trusty-v20180814
  • ubuntu-minimal-1804-bionic-v20180814
  • ubuntu-minimal-1604-xenial-v20180814
• Projects windows-cloud gce-uefi-images and windows-sql-cloud:
  • All Windows Server and SQL Server public images with version number -v201800814 and later include patches.

• CVE-2018-3615
• CVE-2018-3620
• CVE-2018-3646

2018-09-05 Update

CVE-2018-5391 was disclosed on 2018-08-14 by US-CERT. As with CVE-2018-5390, this is a kernel-level networking vulnerability that increases the effectiveness of denial of service (DoS) attacks against vulnerable systems. The main difference is that CVE-2018-5391 is exploitable over IP connections. We updated this bulletin to cover both vulnerabilities.

Description

CVE-2018-5390 ("SegmentSmack") describes a kernel-level networking vulnerability that increases the effectiveness of denial of service (DoS) attacks against vulnerable systems over TCP connections.

CVE-2018-5391 ("FragmentSmack") describes a kernel-level networking vulnerability that increases the effectiveness of denial of service (DoS) attacks against vulnerable systems over IP connections.

Compute Engine impact

The host infrastructure that runs Compute Engine VMs is not at risk. The network infrastructure that handles traffic to and from Compute Engine VMs is protected against this vulnerability. Compute Engine VMs that only send/receive untrusted network traffic using HTTP(S), SSL, or TCP Load Balancers are protected against this vulnerability.

Compute Engine VMs running unpatched operating systems that send/receive untrusted network traffic directly, or using Network Load Balancers, are vulnerable to this DoS attack.

Consider updating your VM instances as soon as patches are available for their operating systems.

Compute Engine customers can update the guest operating systems on their instances using one of the following options:

• Use patched public images to recreate existing VM instances. See the list of patched public images below.
• On existing instances, install patches provided by the operating system vendor and reboot the patched instances.

Patched images and vendor resources

We will provide links to patch information from each operating system vendor here as they become available.

• Project centos-cloud (CVE-2018-5390 only):
  • centos-7-v20180815
  • centos-6-v20180815
• Project coreos-cloud (CVE-2018-5390 and CVE-2018-5391):
  • coreos-stable-1800-7-0-v20180816
  • coreos-beta-1855-2-0-v20180816
  • coreos-alpha-1871-0-0-v20180816
• Project cos-cloud (CVE-2018-5390 and CVE-2018-5391):
  • cos-stable-65-10323-98-0
  • cos-stable-66-10452-109-0
  • cos-stable-67-10575-65-0
  • cos-beta-68-10718-76-0
  • cos-dev-69-10895-16-0
• Project debian-cloud (CVE-2018-5390 and CVE-2018-5391):
  • debian-9-stretch-v20180814
• Project rhel-cloud (CVE-2018-5390 only):
  • rhel-7-v20180814
  • rhel-6-v20180814
• Project suse-cloud (CVE-2018-5390 and CVE-2018-5391):
  • sles-15-v20180816
  • sles-12-sp3-v20180814
• Project suse-sap-cloud (CVE-2018-5390 and CVE-2018-5391):
  • sles-15-sap-v20180816
  • sles-12-sp3-sap-v20180814
  • sles-12-sp2-sap-v20180816
• Project ubuntu-os-cloud (CVE-2018-5390 and CVE-2018-5391):
  • ubuntu-1804-bionic-v20180814
  • ubuntu-1604-xenial-v20180814
  • ubuntu-1404-trusty-v20180814
  • ubuntu-minimal-1804-bionic-v20180814
  • ubuntu-minimal-1604-xenial-v20180814

• CVE-2018-5390
• CVE-2018-5391

2018-05-21 Update

CVE-2018-3640 and CVE-2018-3639, Variants 3a and 4 respectively, were disclosed by Intel. As with the first three variants of Spectre and Meltdown, the infrastructure that runs Compute Engine VM instances is protected and customer VM instances are isolated and protected from one another. Additionally, Compute Engine plans to deploy Intel's microcode patches to our infrastructure, which will allow customers who run untrusted or multi-tenant workloads within a single VM instance to enable additional intra-VM mitigations when those mitigations are provided by operating system vendors and providers. Compute Engine will deploy the microcode patches once Intel has certified them and after Compute Engine has tested and qualified the patches for our production environment. We will provide more detailed timelines and updates on this page as they become available.

Description

These CVEs are variants of a new class of attack that exploit the speculative execution technology available in many processors. This class of attack can allow for unauthorized read-only access to memory data under various circumstances.

Compute Engine used VM Live Migration technology to perform host system and hypervisor updates with no user impact, no forced maintenance windows, and no mass reboots required. However, all guest operating systems and versions must be patched to protect against this new class of attack regardless of where those systems run.

Read the Project Zero blog post for complete technical details on this attack method. Read the Google Security blog post for complete details on Google's mitigations including all product-specific information.

Compute Engine impact

The infrastructure that runs Compute Engine and isolates customer VM instances from each other is protected against known attacks. Our mitigations prevent unauthorized access to our host systems from applications running inside VM instances. These mitigations also prevent unauthorized access between VM instances running on the same host system.

To prevent unauthorized access within your virtual machine instances, you must update the guest operating systems on those instances using one of the following options:

• Use patched public images to recreate your existing VM instances. See the list of patched public images below.
• On your existing instances, install patches provided by the operating system vendor for your distribution and reboot the patched instances. See the links to patch information from each operating system vendor below.

Patched images and vendor resources

Note: Patched images might not include fixes for all of the CVEs listed in this security bulletin notice. Additionally, different images might include different methods for preventing these types of attacks. Check with your operating system vendor to confirm which CVEs they address in their patches and what prevention methods they use.

• Project cos-cloud: Includes patches that prevent Variant 2 (CVE-2017-5715) and Variant 3 (CVE-2017-5754) attacks. Google used Retpoline in these images to mitigate Variant 2 attacks.
  • cos-stable-63-10032-71-0 or image family cos-stable
• Project centos-cloud: CentOS patch information
  • centos-7-v20180104 or image family centos-7
  • centos-6-v20180104 or image family centos-6
• Project coreos-cloud: CoreOS patch information
  • coreos-stable-1576-5-0-v20180105 or image family coreos-stable
  • coreos-beta-1632-1-0-v20180105 or image family coreos-beta
  • coreos-alpha-1649-0-0-v20180105 or image family coreos-alpha
• Project debian-cloud: Debian patch information
  • debian-9-stretch-v20180105 or image family debian-9
  • debian-8-jessie-v20180109 or image family debian-8
• Project rhel-cloud: RHEL patch information
  • rhel-7-v20180104 or image family rhel-7
  • rhel-6-v20180104 or image family rhel-6
• Project suse-cloud: SUSE patch information
  • sles-12-sp3-v20180104 or image family sles-12
  • sles-11-sp4-v20180104 or image family sles-11
• Project suse-sap-cloud: SUSE patch information
  • sles-12-sp3-sap-v20180104 or image family sles-12-sp3-sap
  • sles-12-sp2-sap-v20180104 or image family sles-12-sp2-sap
• Project ubuntu-os-cloud: Ubuntu patch information
  • ubuntu-1710-artful-v20180109 or image family ubuntu-1710
  • ubuntu-1604-xenial-v20180109 or image family ubuntu-1604-lts
  • ubuntu-1404-trusty-v20180110 or image family ubuntu-1404-lts
• Projects windows-cloud and windows-sql-cloud:
  • All Windows Server and SQL Server public images with version number -v20180109 and later include patches. However, you must follow the recommended actions provided by Microsoft in the Windows Server guidance support bulletin to enable and verify these mitigations on both your existing instances and newly-created instances.

Use these images to recreate your VM instances. Earlier versions of these public images don't contain these patches and don't mitigate potential attacks.

Patches from hardware vendors

NVIDIA provides patched drivers to mitigate potential attacks against systems that have NVIDIA® driver software installed. To learn which driver versions are patched, read the NVIDIA GPU Display Driver Security Updates security bulletin from NVIDIA.

Revision history:

• 2018-05-21 T 14:00 PST: Added information about 2 new variants disclosed on May 21, 2018.
• 2018-01-10 T 15:00 PST: Added information about patched Windows Server and SQL Server public images.
• 2018-01-10 T 10:15 PST: Added several Ubuntu images to the list of patched public images.
• 2018-01-10 T 09:50 PST: Added guidance for patches from hardware vendors.
• 2018-01-03 to 2018-01-09: Made several revisions to the list of patched public images.

• CVE-2017-5753
• CVE-2017-5715
• CVE-2017-5754
• CVE-2018-3640
• CVE-2018-3639