3 ms·

I just saw a bunch of our SoftLayer VMs get rebooted (with ahead notification) and they seem to use Xen. They probably got notification too. Looks like my othe

by api 11y ago

I just saw a bunch of our SoftLayer VMs get rebooted (with ahead notification) and they seem to use Xen. They probably got notification too. Looks like my others (Digital Ocean, Vultr) use KVM (according to virt-what). Did anyone see Amazon do reboots? I wonder if Amazon has some method of hot-patching kernel and Xen code under the hood? There are such things, and that would be some interesting secret sauce.

walterbell 11y ago
Here's a talk and wiki page on Xen hot-patching (xsplice), from the Aug 2015 Xen Summit: http://wiki.xen.org/wiki/XSplice http://wiki.xen.org/wiki/XSplice & https://youtu.be/C2R79Ob8KOA https://youtu.be/C2R79Ob8KOA
dangrossman 11y ago
Earlier this year: > Our team has been working around-the-clock to find ways to minimize the impact for those requiring a reboot. We're happy to share that we'll now be able to live-update ‎the vast majority of our older hardware for this Xen Security Advisory. https://aws.amazon.com/premiumsupport/maintenance-2015-03/ https://aws.amazon.com/premiumsupport/maintenance-2015-03/ There's been a few subsequent articles mentioning Amazon's ability to hot-patch Xen without a reboot. They didn't perform a reboot for this vulnerability.
- samstave 11y ago
  Out of the 1,000+ instances I had running in AWS during that last major reboot -- there were only a handful of hosts affected. Sadly, some of them were the very primary core DBs -- but in general, it was still only a handful. Luckily, many people also converted to HVM over PV already. IIRC it was largely PV instances in EC2 classic... but I can't be sure.
  - sn 11y ago
    Memories are short. What about VENOM https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456 which affected both Xen HVM and KVM? Then there was http://xenbits.xen.org/xsa/advisory-110.html http://xenbits.xen.org/xsa/advisory-110.html which is privilege escalation in HVM mode. Regardless of the virtualization technology, you need to keep on top of disclosures. Any public provider running xen should be on the disclosure list by now http://www.xenproject.org/security-policy.html http://www.xenproject.org/security-policy.html
some1else 11y ago
Linode rebooted mine on 21st

by api 11y ago

walterbell 11y ago

Here's a talk and wiki page on Xen hot-patching (xsplice), from the Aug 2015 Xen Summit: http://wiki.xen.org/wiki/XSplice http://wiki.xen.org/wiki/XSplice & https://youtu.be/C2R79Ob8KOA https://youtu.be/C2R79Ob8KOA

dangrossman 11y ago

Earlier this year: > Our team has been working around-the-clock to find ways to minimize the impact for those requiring a reboot. We're happy to share that we'll now be able to live-update ‎the vast majority of our older hardware for this Xen Security Advisory. https://aws.amazon.com/premiumsupport/maintenance-2015-03/ https://aws.amazon.com/premiumsupport/maintenance-2015-03/ There's been a few subsequent articles mentioning Amazon's ability to hot-patch Xen without a reboot. They didn't perform a reboot for this vulnerability.

samstave 11y ago
Out of the 1,000+ instances I had running in AWS during that last major reboot -- there were only a handful of hosts affected. Sadly, some of them were the very primary core DBs -- but in general, it was still only a handful. Luckily, many people also converted to HVM over PV already. IIRC it was largely PV instances in EC2 classic... but I can't be sure.
- sn 11y ago
  Memories are short. What about VENOM https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456 which affected both Xen HVM and KVM? Then there was http://xenbits.xen.org/xsa/advisory-110.html http://xenbits.xen.org/xsa/advisory-110.html which is privilege escalation in HVM mode. Regardless of the virtualization technology, you need to keep on top of disclosures. Any public provider running xen should be on the disclosure list by now http://www.xenproject.org/security-policy.html http://www.xenproject.org/security-policy.html

some1else 11y ago

Linode rebooted mine on 21st