Hacker News new | past | comments | ask | show | jobs | submit login

Can this attack allow the attacker to escape public cloud isolation methods and break into the control plane or other VMs?



That depends on what you mean by "break into". If you mean sample data (read) from the control plane or other VMs, then yes; however, the attacker may have difficulty targeting which data is read. The attacker would not be able to write to that memory or gain any sort of execution privilege using this method alone.


It would have, but it's likely the cloud vendors have already deployed defenses.


Today's AWS[1] and Google Cloud[2] security bulletin notes that all their host infrastucture (read: cpu firmware/microcode) has been updated to mitigate the issues disclosed today by Intel[3]. I could not find anything for Azure yet.

I also note that the provided OSes are being updated with mitigations as well, so for complete mitigation of the issue you'll probably need to update your OS.

[1] https://aws.amazon.com/security/security-bulletins/AWS-2019-...

[2] https://cloud.google.com/compute/docs/security-bulletins#201...

[3] https://www.intel.com/content/www/us/en/security-center/advi...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: