4 ms·
They don't, but it doesn't matter. Something compiled with retpoline is resilient from it's execution being impacted. Once KVM is recompiled with retpoline, gu
by cthalupa 9y ago
They don't, but it doesn't matter.
Something compiled with retpoline is resilient from it's execution being impacted. Once KVM is recompiled with retpoline, guests cannot attack it via spectre variant 2, and as such, cannot attack other guests.
The hypervisor being compiled with retpoline, however, does nothing to protect from intra-guest attacks - if you have untrusted code running in your VM, and you don't have IBRS and the other microcode features on, or your sensitive apps compiled with retpoline, you are still vulnerable internally. Just not from other guests
- cm2187 9y agoEffectively both Linux and Windows Server need to be fully recompiled. Hope someone hasn’t lost some source code. I am not super familiar with google’s offering but I suspect they don’t just offer VMs. Anything that runs in a shared infrastructure (serverless design/websites hosting) runs on top of a Linux box I presume. Google would need to get those Linux binaries recompiled too, not just the hypervisor.
- dx034 9y agoI'm pretty sure that Microsoft can easily recompile Windows. Probably even Windows 95 with some prep time.
- cm2187 9y agoA hack they used in a recent update (I believe for the equation editor) suggests that's probably not the case.
- joshuamorton 9y agoI believe that the equation editor was third party coffee to which Ms never had the source code.
- cm2187 9y agoThe point is they can’t recompile it.