4 ms·
from what i understand, it’s both. if you don’t protect the hypervisor, the guest can break through and read it’s ram. if you don’t protect the host, your apps
by rickycook 9y ago
from what i understand, it’s both. if you don’t protect the hypervisor, the guest can break through and read it’s ram. if you don’t protect the host, your apps can break into your own OS and see it’s ram.
i could be wrong; if i am, clarification would be good!
- chrisper 9y agoYes it is both now. The host patch protects against vm-to-vm leaks, but you still need to protect your vm against application-to-application leaks. When I wrote the other comment it was at the time I did not have all the information we have now. Like it took me some time to read into it.
- amluto 9y agoThe host PTI patch does nothing whatsoever to protect from attacks initiated by a guest. (Well, if host QEMU gets compromised, PTI protects the host kernel a bit.)