4 ms·

I am pretty sure the patch needs to be applied on the host kernel and not the guest.

• rickycook 9y ago
  from what i understand, it’s both. if you don’t protect the hypervisor, the guest can break through and read it’s ram. if you don’t protect the host, your apps can break into your own OS and see it’s ram. i could be wrong; if i am, clarification would be good!
  • chrisper 9y ago
    Yes it is both now. The host patch protects against vm-to-vm leaks, but you still need to protect your vm against application-to-application leaks. When I wrote the other comment it was at the time I did not have all the information we have now. Like it took me some time to read into it.
    • amluto 9y ago
      The host PTI patch does nothing whatsoever to protect from attacks initiated by a guest. (Well, if host QEMU gets compromised, PTI protects the host kernel a bit.)
• alpb 9y ago
  This is not true. https://cloud.google.com/compute/docs/security-bulletins https://cloud.google.com/compute/docs/security-bulletins says: > However, all guest operating systems and versions must be patched to protect against this new class of attack regardless of where those systems run.
  • chrisper 9y ago
    It depends on what you try to fix. VM - to - VM is host only. But now it seems it also needs to be applied to guests because of applications inside the guests which could abuse this as well.