Tutorial [KVM/XEN] HW_AES Detection Issues - (yum update - Illegal instruction)

cPanel Support has received several inquiries over the past month regarding a particular issue. This issue occurs on CentOS 6.8 XEN servers when you perform a system update via 'yum update', or when you attempt a cURL request. These commands typically result in an 'Illegal instruction (core dumped)' error.

The issue is due to Python attempting to execute a CPU opcode that is advertised as available by the server's host node virtualization system (XEN), but is not actually supported by the host node's hardware. With this in mind, please note and understand the issue being experienced is not a cPanel related error. The core of this issue is due to the host node's virtualization system (XEN) and the Network Security Services (nss*) packages.

A few examples of errors being reported as result of this issue:
There have also been reports of Softaculous and RVSiteBuilder not functioning properly, resulting with a 500 error similar to the following:
Similar to cPanel's Feature Request and Bug Reporting processes, you are highly recommended to provide feedback on the official upstream bug reports regarding this issue.

For reference, please see these available upstream bug reports regarding this issue:

• Redhat KB - Segfaults in libfreeblpriv3.so (Solution In Progress - Updated May 27 2016 at 7:10 PM)
• Redhat Bugzilla - 1257332
• Redhat Bugzilla - 1249426
• Chromium Bugs - 320524

Temporary Workarounds

[ /!\ WARNING /!\ ] - cPanel can not be held liable for the results of the temporary work around provided.

Throughout the span of the this reported issue, cPanel Support has discovered a temporary workaround. To enable this temporary workaround, execute the following as the root user:
[ (!) NOTE (!) ] - The 'NSS_DISABLE_HW_AES' environment variable, disables AES hardware support. More information on AES can be found here: Intel Data Protection (AES)

As a temporary workaround to resolve the errors reported with Softaculous and RVSiteBuilder, the following steps have been used successfully:

1. Copy and paste all of the following code as the root user:
   • Code:

     cat <<EOF > /usr/local/cpanel/3rdparty/etc/temporary-aes-fix.php
     <?php
     putenv("NSS_DISABLE_HW_AES=1");
     \$_ENV["NSS_DISABLE_HW_AES"]="1";
     EOF

   • NOTE: The command provided will create the file with the necessary content. The final '/usr/local/cpanel/3rdparty/etc/temporary-aes-fix.php' should only contain the following content:
   • Code:

     <?php
     putenv("NSS_DISABLE_HW_AES=1");
     $_ENV["NSS_DISABLE_HW_AES"]="1";

2. Create a backup of your server's existing cPanel PHP configuration file (/usr/local/cpanel/3rdparty/etc/php.ini) and add the following entry:
   • Code:

     cp -av /usr/local/cpanel/3rdparty/etc/php.ini{,.before_aes_fix}; \
     echo 'auto_prepend_file = "/usr/local/cpanel/3rdparty/etc/temporary-aes-fix.php"' >> /usr/local/cpanel/3rdparty/etc/php.ini