4 ms·
Naturally the first vulnerability they point out was never exploitable for cross-VM attacks on any major cloud provider at any point…
by johncolanduoni 3y ago
Naturally the first vulnerability they point out was never exploitable for cross-VM attacks on any major cloud provider at any point…
- qaq 3y agoThats a strong statement we only know about breaches that have a) being identified b) publicly disclosed
- johncolanduoni 3y agoIt requires concurrent execution on the same core of multiple VMs, which none of the major cloud providers do (at least on machines new enough to have Zen cores).
- qaq 3y agoSure they do for "serverless workloads"
- johncolanduoni 3y agoI can’t find specific documentation that indicates that AWS deploys firecracker with core isolation (though I would be pretty surprised if they didn’t given their documented caution around shared-core VMs). Google uses gVisor with Linux Core Scheduling to prevent this for GKE sandbox, but I can’t find any documentation that they do the same for Cloud Functions. In any case ”don’t use serverless functions” is a very far goalpost from “move back to the data center”.
- qaq 3y agoThat is not the only possible vulnerability.