3 ms·
I think it s a response to the "containers can't contain agents we need VMs" which didn't go far enough. Qemu/KVM is the type of software that maybe isn't fixab
by justincormack 1mo ago
I think it s a response to the "containers can't contain agents we need VMs" which didn't go far enough. Qemu/KVM is the type of software that maybe isn't fixable, it has a huge surface area of features (all in memory unsafe languages) that have to be fixed, and maybe its not going to be fixed. If everyone who needs strong security reads this and uses firecracker or whatever instead (I mean, they probably mostly are), then maybe there will be even less pressure to fix the convenient stuff in Debian.
- bonzini 1mo agoNote that the author didn't use any QEMU guest-to-host vulnerability here. The agent found a logic bug that facilitated going straight for the hypervisor from inside the guest, but it isn't caused by the use a memory-unsafe language. Here is the fix: https://lore.kernel.org/qemu-devel/20260826181552.848617-3-pbonzini@redhat.com/ https://lore.kernel.org/qemu-devel/20260826181552.848617-3-p...
- justincormack 1mo agoAh thats an interesting one.
- bonzini 1mo agoAnd an old one. It's only needed for Windows XP/2003 and honestly it should be retired.