4 ms·
I use AWS instances (multi-tenant). I understand that by now AWS hypervisors have been patched. Does that fully protect my unpatched AWS instances from this CP
by antaviana 9y ago
I use AWS instances (multi-tenant). I understand that by now AWS hypervisors have been patched.
Does that fully protect my unpatched AWS instances from this CPU-level issues?
If not, is there any way to protect my AWS instance from a rogue unpatched attacker instance running on the same hypervisor?
In other words, with the current CPUs deployed at AWS, will it be possible for an attacker to simply launch an unpatched instance to steal data from other instances (patched or not) running on the same AWS hypervisor?
I hope not, because the cloud multi-tenant model would be effectively dead until AWS hosts with unaffected CPUs are available.
- infogulch 9y agoIn general, the multi-tenant security model does not rely on a malicious tenant being limited to any OS or patch (they can and always will be able to run whatever code they want including OS, and it's designed to still be secure). The cross-VM attacks we've seen actually go through the hypervisor, and since that is patched you should be fine if you're patched.
- tptacek 9y agoNo. The "master" software fix to Meltdown keeps userland and the kernel from trivially sharing kernel memory pages. If your guest kernel doesn't have this fix applied, then your guest userland shares pages with your guest kernel, and guest processes can dump kernel memory.
- tedunangst 9y agoIn theory it should be possible for a hyper visor to retrofit a fix into a guest, but it's messy and I doubt anyone will ever do it. Could be fun though. Quick sketch: disable EPT and go back to shadow paging. Maintain a third page table with any kernel pages unmapped. Invisibly swap between on syscalls.
- wolf550e 9y agoThis sounds really slow to me. What is the overhead of "disable EPT and go back to shadow paging", or what was the performance win of EPT?