4 ms·

I think it’s the other way around.. and the host updates are what have been introducing these performance hits as well.

• bonzini 9y ago
  What is the other way round? (I worked on the fixes for Red Hat).
  • yborg 9y ago
    I think he's saying that unpatched, a co-resident VM can compromise the host even if you are locally patched. If the host is patched this doesn't matter (for VM escapes); however, for those on public clouds that will apply the host patching globally, you will be eating the performance degradation whether or not your workload cares about it. I don't think AWS et al will be offering a "run unpatched instance" option. Or maybe they will, this looks pretty devastating for some workloads; on the other hand, cloud providers could actually end up making a lot of money from this issue...
    • bonzini 9y ago
      No, that is not the case. The hypervisor is able to protect myself from unpatched guests, at a performance cost of course...