4 ms·
Per AWS, they aren't affected (not shocking, they run very custom Xen), and even so, the info you upload to tarsnap is already encrypted client-side, that being
by akerl_ 11y ago
Per AWS, they aren't affected (not shocking, they run very custom Xen), and even so, the info you upload to tarsnap is already encrypted client-side, that being the whole point.
- vox_mollis 11y agoRight, they are not currently affected, because they got advance notice. But it's very likely that Alibaba sat on the vuln for a long time, and Chinese intelligence knew about it. It's prudent to consider all data on ec2 servers compromised and act accordingly.
- walterbell 11y agoToo bad we don't know how Alibaba found this vuln, so the technique can be used to audit the rest of the Xen codebase.
- lsc 11y agoso my speculation (and this is pure speculation) is that they're still running something based on the older rhel5-xen on their paravirt guests, on the general "if it's not broken, don't fuck with it" model. I think that the RHEL5 hypervisor is old enough to not be vulnerable to this problem.
- walterbell 11y agoWould rhel5-xen work on recent-ish servers, let's say 2012?
- lsc 11y agoYeah. AHCI is AHCI.... and if you did have drivers for newer RAID cards and the like, those can be backported with a reasonable number of hours of the skill level amazon can reasonably hire.