Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Januscape: Guest-to-Host Escape in KVM/x86 [CVE-2026-53359]

github.com

Post reply on HN
Print view View original

61–67 of 67 posts

Re: Januscape: Guest-to-Host Escape in KVM/x86 [CVE-2026-53359]

#61

Post by calvinmorrison »

cyberax wrote: post #28
calvinmorrison wrote: post #25

Earlier quoted context omitted.

Really? We basically never go onsight. Ticket in with the colo and they can help.

That really works well while you have a rack or so. Afterwards, you really need people who know all the details of networking and storage. Especially if you're designing something without a SPOF. What's changing is the scope of things that you can run on that one rack. 15 years ago, I was running clusters of 30 computers to do things that I now can do with 1.

Nope... last time i was on site was when we migrated data centers. a dozen racks.

Re: Januscape: Guest-to-Host Escape in KVM/x86 [CVE-2026-53359]

#63

Post by bonzini »

nijave wrote: post #58
bonzini wrote: post #50

Earlier quoted context omitted.

That's exactly the same as x86. Nested virtualization support is almost entirely in the hypervisor.

x86 doesn't have a firmware hypervisor that allows splitting into LPARs. That's showing 3 layers of nesting: LPAR, hypervisor, nested hypervisor

On POWER, LPARs and the first level of hypervisor do not use any LPAR-specific nesting support in the processor. It's all handled by the firmware, not the hardware.

Re: Januscape: Guest-to-Host Escape in KVM/x86 [CVE-2026-53359]

#64

Post by antonvs »

TZubiri wrote: post #21
antonvs wrote: post #9

Earlier quoted context omitted.

If you can run everything you need on two or three servers, what you describe can work. But it’s still hobby status, basically. The equation changes when the scale gets significantly bigger. Managing a non-trivial hardware fleet requires people, and people cost money. The reason “managed services” of all kinds, including cloud services, are so widespread in business is because someone else is managing things so that…

There seems to be some confusion, although one other user interpreted the same thing, I still believe it's a misinterpretation. I said dedicated servers, I never said anything about owning or managing the hardware. You can rent a dedicated server. The decision to virtualize and the decision to own the hardware are separate decisions.

It doesn't really make any difference. Managing "dedicated servers" essentially requires the same level of effort as managing hardware.

Re: Januscape: Guest-to-Host Escape in KVM/x86 [CVE-2026-53359]

#65

Post by TZubiri »

antonvs wrote: post #64
TZubiri wrote: post #21

Earlier quoted context omitted.

There seems to be some confusion, although one other user interpreted the same thing, I still believe it's a misinterpretation. I said dedicated servers, I never said anything about owning or managing the hardware. You can rent a dedicated server. The decision to virtualize and the decision to own the hardware are separate decisions.

It doesn't really make any difference. Managing "dedicated servers" essentially requires the same level of effort as managing hardware.

Nope, I've rented a dedicated server through OVH and I never had to touch a single cable or change a single disk.

I also dealt with owned servers and I had to deal with power outages and gas based generators, internet outages caused by too high trucks taking out a data line, and UPS beeping because their battery life was nearing zero.

So there's a non trivial difference there.

Re: Januscape: Guest-to-Host Escape in KVM/x86 [CVE-2026-53359]

#66

Post by jononor »

nijave wrote: post #54
TZubiri wrote: post #7

hey, here's a good rule of thumb. If you share resources, that reduces costs, but increases security risks. choose whether to share a filesystem, an OS, a kernel, hardware, or just use a dedicated server. The economics of sharing resources are all in a tiny sliver of the budget spectrum, the shoestring budget range : 0-1$/mo: serverless 1$-5$/mo containers 5$-200$/mo Virtual Machine(s) 200$-1Billion$/month , at least…

I'm a bit confused. So you're saying instead of running 20 containers for an app that are 1-4Gi and some odd CPU I should replace them with 20 dedicated servers? By your own numbers that's 200x+ as expensive. Really 20 containers is a pretty small app considering 5 app server containers, a DB, a cache, a load balancer, some monitoring/alerting crap 2x for redundancy.

I believe the proposed system is to run the containers on dedicated rented server(s). Instead of having the containers/VMs share underlying CPU/RAM with others.

Re: Januscape: Guest-to-Host Escape in KVM/x86 [CVE-2026-53359]

#67

Post by fulafel »

TZubiri wrote: post #7

hey, here's a good rule of thumb. If you share resources, that reduces costs, but increases security risks. choose whether to share a filesystem, an OS, a kernel, hardware, or just use a dedicated server. The economics of sharing resources are all in a tiny sliver of the budget spectrum, the shoestring budget range : 0-1$/mo: serverless 1$-5$/mo containers 5$-200$/mo Virtual Machine(s) 200$-1Billion$/month , at least…

A dedicated server is a bunch of risk and skilled administration work compared to using a container platform or serverless. Many more people have been pwned by consequences of neglected server administration than managed serverless/container platform VM escapes.
Post reply on HN