7 ms·
Can this attack allow the attacker to escape public cloud isolation methods and break into the control plane or other VMs?
by polskibus 7y ago
Can this attack allow the attacker to escape public cloud isolation methods and break into the control plane or other VMs?
- readams 7y agoIt would have, but it's likely the cloud vendors have already deployed defenses.
- mattashii 7y agoToday's AWS[1] and Google Cloud[2] security bulletin notes that all their host infrastucture (read: cpu firmware/microcode) has been updated to mitigate the issues disclosed today by Intel[3]. I could not find anything for Azure yet. I also note that the provided OSes are being updated with mitigations as well, so for complete mitigation of the issue you'll probably need to update your OS. [1] https://aws.amazon.com/security/security-bulletins/AWS-2019-004/ https://aws.amazon.com/security/security-bulletins/AWS-2019-... [2] https://cloud.google.com/compute/docs/security-bulletins#20190514 https://cloud.google.com/compute/docs/security-bulletins#201... [3] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html https://www.intel.com/content/www/us/en/security-center/advi...
- robmccoll 7y agoThat depends on what you mean by "break into". If you mean sample data (read) from the control plane or other VMs, then yes; however, the attacker may have difficulty targeting which data is read. The attacker would not be able to write to that memory or gain any sort of execution privilege using this method alone.