2 ms·
Only Spectre CVE-2017-5715 can escape a VM, not Meltdown. Even then, you don't need to trust your co-tenants. Updating the host (which your provider has alread
by bonzini 9y ago
Only Spectre CVE-2017-5715 can escape a VM, not Meltdown.
Even then, you don't need to trust your co-tenants. Updating the host (which your provider has already done, or which is anyway out of your control) is both necessary and sufficient to protect from VM escapes.
- mwarkentin 9y agoI think it’s the other way around.. and the host updates are what have been introducing these performance hits as well.
- bonzini 9y agoWhat is the other way round? (I worked on the fixes for Red Hat).
- yborg 9y agoI think he's saying that unpatched, a co-resident VM can compromise the host even if you are locally patched. If the host is patched this doesn't matter (for VM escapes); however, for those on public clouds that will apply the host patching globally, you will be eating the performance degradation whether or not your workload cares about it. I don't think AWS et al will be offering a "run unpatched instance" option. Or maybe they will, this looks pretty devastating for some workloads; on the other hand, cloud providers could actually end up making a lot of money from this issue...
- bonzini 9y agoNo, that is not the case. The hypervisor is able to protect myself from unpatched guests, at a performance cost of course...