CentOS 6 Illegal Instruction TLS Bug

Knowledgebase

39Steadfast Cloud Platform 3Full Management 38Dedicated Servers & Colocation 4Control Panels 19Other

Posted by Kevin Stange, Last modified by Josh Simmons on 14 September 2021 09:02 AM

*****Warning: CentOS 6 is now EOL. As CentOS 6 will no longer receive security and other important updates, it is highly recommended that you upgrade to an actively supported operating system*****

Starting with CentOS 6.8, a newly introduced update to NSS causes certain applications to be unable to connect via TLS using GCM ciphers on virtual machines. This article describes the technical problem and how to apply the solution.

Symptoms and Detection

This issue affects virtual machines in very specific cases. It can be reproduced with a very simple connection test:

# curl https://google.com --ciphers ecdhe_rsa_aes_128_gcm_sha_256
Illegal instruction (core dumped)

This will cause other applications to crash with similar error messages when they attempt to connect to a TLS server or serve a TLS client using any GCM cipher. You can verify that the issue is caused by misdetected hardware capabilities, by repeating the same command with NSS_DISABLE_HW_GCM=1 set:

# NSS_DISABLE_HW_GCM=1 curl https://google.com --ciphers ecdhe_rsa_aes_128_gcm_sha_256
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="https://www.google.com/">here</A>.
</BODY></HTML>

If you use another cipher, there's no problem:

# curl https://google.com --ciphers ecdhe_rsa_aes_128_cbc_sha_256
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="https://www.google.com/">here</A>.
</BODY></HTML>

Solution

Red Hat and CentOS fixed this issue in NSS Softokn version 3.14.3-23.3.el6_8. To apply this fix on a system that is experiencing the bug, try the following command:

NSS_DISABLE_HW_GCM=1 yum -y update nss-softokn nss-softokn-freebl

References

This issue has been reported and discussed in a number of places.

(3 vote(s))

Helpful

Not helpful

Comments (0)