yum and curl showing illegal instruction

[rm -rf]

Yes. This issue seems to be not that important to them.

I found a post from 17th of May, where someone already posted a workaround to this issue.
Not many CentOS under virtualization. Or not many hosts with AES cpu flags.

The bug tracker here https://bugs.centos.org/view.php?id=10930 shows Severity as major. I'm new to CentOS administration. In your experience how fast do those bugs get patched?

Also did you follow the solution here https://bugs.centos.org/view.php?id=10930#c26705 to fix it?

I have two XenPV VM's, one running CentOS and one running CloudLinux, and after the 6.8 update I'm getting the exact same errors as you on both of them.

Code: Select all

yum update
Loaded plugins: fastestmirror
Setting up Update Process
Loading mirror speeds from cached hostfile
Illegal instruction

Code: Select all

curl https://www.google.com
Illegal instruction

Code: Select all

grep -i aes /proc/cpuinfo
flags		: fpu de tsc msr pae cx8 sep cmov pat clflush mmx fxsr sse sse2 ss ht syscall nx lm rep_good unfair_spinlock pni pclmulqdq ssse3 cx16 pcid sse4_1 sse4_2 popcnt tsc_deadline_timer aes avx hypervisor lahf_lm
flags		: fpu de tsc msr pae cx8 sep cmov pat clflush mmx fxsr sse sse2 ss ht syscall nx lm rep_good unfair_spinlock pni pclmulqdq ssse3 cx16 pcid sse4_1 sse4_2 popcnt tsc_deadline_timer aes avx hypervisor lahf_lm

Code: Select all

grep -o aes /proc/cpuinfo
aes
aes

[ross.motley]

Hi,

We've encountered this problem on our Rackspace cloud servers, and taking inspiration from http://www.unixmen.com/rhel-centos-6-4- ... 14-update/ we have a workaround which seems to be working for yum and curl via Wordpress/PHP/Apache.

Created /etc/profile.d/nss.sh and added:

Code: Select all

export NSS_DISABLE_HW_AES=1

Add the following to /etc/grub.conf:

Code: Select all

systemd.setenv=NSS_DISABLE_HW_AES=1

Added the following to /etc/sysconfig/init:

Code: Select all

export NSS_DISABLE_HW_AES=1

I hope this is helpful,

Thanks,

Ross

[TrevorH]

This issue is not CentOS specific - it also occurs on RHEL 6.8 and they have a status page https://access.redhat.com/solutions/2313911 to track updates to the issue. Last time I looked at it, it said "no solution as yet". It appears that they believe this only or mainly affects xen guests so if anyone is affected here that is not on a xen guest, please let us know.

[jkinsc168]

here is a PHP specific workaround:

putenv("NSS_DISABLE_HW_AES=1");

Thanks,

Joe

[TrevorH]

All these are workarounds and should only be used if you are affected by the problem. From the known information so far, it appears that this only affects virtual machines that are running on xen on hardware that supports aes and/or avx instructions.

[nerdinteractive]

This is perfect Joe. Thanks so much!!

here is a PHP specific workaround:

putenv("NSS_DISABLE_HW_AES=1");

Thanks,

Joe

[lixdeg]

Looks like a hard issue to fix. If it isn't a XEN issue, Redhat might want to convince us to move to KVM

I found it interesting that Steadyfast provides a repo to fix that issue based on a fix from 2013???
https://bugzilla.mozilla.org/show_bug.cgi?id=940794

If you interested in the repo itself read the post on the CENTOS bugtracker
https://bugs.centos.org/view.php?id=10930#c26844

[gryzli]

I have written some detailed article in a blog post, on how to get fixed the illegal instruction problem for a different use cases (including cPanel and PHP).

Here is the link:
https://gryzli.info/2016/05/28/centos-6 ... ion-error/