4 ms·

Thanks for the follow-up! I'll settle for "no tier-1 US provider publicly admits to using QEMU". :) I didn't dig too far into the AWS vulnerability list to try

by j_s 10y ago

Thanks for the follow-up! I'll settle for "no tier-1 US provider publicly admits to using QEMU". :) I didn't dig too far into the AWS vulnerability list to try to find QEMU; XEN shows up right away! Ok: QEMU is last mentioned July 2015, and in none of the mentions is AWS vulnerable. https://www.google.com/?q=site:https://aws.amazon.com/security/security-bulletins/+qemu https://www.google.com/?q=site:https://aws.amazon.com/securi...

bonzini 10y ago
> and in none of the mentions is AWS vulnerable. Yep, that's because most bugs are found in legacy devices that are never found in production. The big exception was a buffer overflow in the floppy device emulation (the "VENOM" vulnerability). A lot of AWS security bulletins say "AWS customers' data and instances are not affected by these issues". I read it as "we knew about it a couple weeks in advance and have done a rolling upgrade". :)