IT41592: IBM MQ might become unresponsive due to delays in its cyptographic provider

APAR status

• Closed as program error.

Error description

• During Queue Manager startup or whilst running MQ commands, MQ
  may become unresponsive due to delays in its cyptographic
  provider
  
  In a containerised environment this may result in a "liveness
  probe" failure with an exit status of 72 (or 137). The following
  may also be observed in the logs:
  
  2022-07-18T11:32:47.419203551+07:00 2022-07-18T04:32:47.419Z MQ
  version: 9.3.0.0
  2022-07-18T11:32:47.419203551+07:00 2022-07-18T04:32:47.419Z MQ
  level: p930-L220606
  2022-07-18T11:32:47.419203551+07:00 2022-07-18T04:32:47.419Z MQ
  license: Production
  2022-07-18T11:47:56.980858762+07:00 2022-07-18T04:47:56.980Z
     Signal received: terminated
  2022-07-18T11:47:56.980917011+07:00 2022-07-18T04:47:56.980Z
     Stopping queue manager
  2022-07-18T11:47:56.989238345+07:00 2022-07-18T04:47:56.989Z
     Error getting status for queue manager XYZ:
  /opt/mqm/bin/dspmq: exit status 72
  

Local fix

• Set environment variable "ICC_SHIFT=3" below the "# Global
  Settings" stanza in the following files:
  
  /opt/mqm/gskit8/lib/C/icc/icclib/ICCSIG.txt
  /opt/mqm/gskit8/lib/N/icc/icclib/ICCSIG.txt
  /opt/mqm/gskit8/lib64/C/icc/icclib/ICCSIG.txt
  /opt/mqm/gskit8/lib64/N/icc/icclib/ICCSIG.txt
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users of MQ TLS using versions of GSKit prior to 8.0.55.31
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  There is an issue between the GSKit component used in IBM MQ and
  some AMD processors where the GSKit random number generator
  module loops indefinitely due to a difference in the AMD chip's
  clock.
  The environment variable ICC_SHIFT=3 changes the behaviour of
  GSKit, bypassing the problem.
  

Problem conclusion

• The problem has been resolved in the non-FIPS ICC module of
  GSKit version 8.0.55.31.  MQ by default uses the non-FIPS ICC
  module with this version of GSKit.
  
  FIPS mode users (either configured using the MQSSLFIPS
  environment variable set or runmqsc ALTER QMGR SSLFIPS(YES)
  command) will need to apply the mentioned local fix workaround.
  
  The GSKit team indicate the problem will be fully resolved in a
  future release of the FIPS 140-3 ICC module (currently pending
  NIST approval) contained in version 8.0.56.x of GSKit.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.3 LTS   9.3.0.6
  v9.x CD    9.3.3
  
  The latest available maintenance can be obtained from
  'IBM MQ Recommended Fixes'
  https://www.ibm.com/support/pages/recommended-fixes-ibm-mq
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'IBM MQ
  Planned Maintenance Release Dates'
  https://ibm.biz/mqplannedmaintenance
  
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MQ BASE V9.3

• Fixed component ID

  5724H7291

Applicable component levels