3 ms·
> Does it? If customers can't run code on those servers, then these CPU level side channel attacks aren't an issue. This assumes the servers for S3 etc are dedi
by msbarnett 7y ago
> Does it? If customers can't run code on those servers, then these CPU level side channel attacks aren't an issue.
This assumes the servers for S3 etc are dedicated to the task.
I’m not sure that follows. Unpatched, most of these Intel CVEs are almost like unpatched local privilege escalation vulnerabilities. Once you’ve compromised a low privilege process you can sniff your way to more and more powerful credentials on the machine, host, and in the network.
Unless higher abstraction cloud service providers are dumb enough to just run everything as root, in which case this doesn’t change anything, they probably can’t (competently) get away with not patching these. Defence in depth matters.