| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20141103071856.GA28745@gondor.apana.org.au> Date: Mon, 3 Nov 2014 15:18:56 +0800 From: Herbert Xu <herbert@...dor.apana.org.au> To: Evan Gilman <evan@...erduty.com> Cc: steffen.klassert@...unet.com, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, mwoodson@...hat.com Subject: Re: Sporadic ESP payload corruption when using IPSec in NAT-T Transport Mode Evan Gilman <evan@...erduty.com> wrote: > > I tried to find a reference to the previous report of aesni-intel > causing IPSec corruption under Xen - I'd be interested to read it if > anyone here has it on hand. For now, we are looking to blacklist > aesni-intel as we have no other suitable solution, and when combined > with our other bug, has a detrimental effect on our infrastructure. Unfortunately the bug is marked as private but it's https://bugzilla.redhat.com/show_bug.cgi?id=1085025 FWIW it was also observed on AWS. There is speculation that switching to HVM may fix it. If that were the case, then it's highly likely that this is a bug in the Xen paravirt code. It would also mean that if you cannot switch over to HVM then the most appropriate fix would be to not use aesni-intel. Cheers, -- Email: Herbert Xu <herbert@...dor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists