3 ms·
Definitely. It could have very easily gone the other way - AFAIK that guard page was not to defend against this sort of issue. What's great is that Firecracker
by staticassertion 4y ago
Definitely. It could have very easily gone the other way - AFAIK that guard page was not to defend against this sort of issue. What's great is that Firecracker now does have explicit guard pages that they allocate in response to this, which to me indicates that they're not just a project that patches a vulnerability but thinks through how to protect against classes of vulnerability.
- tptacek 4y agoThey do all sorts of things for security, which is one of the "tenets" (an Amazon thing) of the project. For instance: the reason we haven't had easy access to GPUs is that they don't fit easily into the Firecracker architecture.