21–30 of 50 posts
Earlier quoted context omitted.
Good thing the host you run Docker on never needs to be patched or rebooted I guess?
Yes, docker is immune to vulnerabilities because containers.
If the hypervisor (Xen!) running underneath your container-Linux is vulnerable, the attacker can get access to your virtualized OS and circumvent any container isolation.
Xen's hypervisor would seem to be a great place to implement live patching like KSplice/kGraft/Kpatch does for the Linux kernel. Presumably that stuff still works on KVM host machines with live guests.
At the 31c3 somebody had shown or told the audience about an issue in the Xen hypervisor that allowed someone to break into the host from the guest.
Just received a message from Rackspace cloud regarding theses, it seems like they will have to reboot all instances. See https://community.rackspace.com/general/f/53/t/4978
Yet linode is still silent...
"We’ve received a Xen Security Advisory that requires us to update a portion of our Amazon EC2 fleet. Fewer than 10% of EC2 customer instances will need to be rebooted. We’ve started notifying affected customers when their reboots will take place. These updates must be completed by March 10, 2015 before the underlying issues we are addressing are made public. Following security best practices, the details behind these issues will be withheld until they are made public on March 10."
Earlier quoted context omitted.
See ya later uptime... 04:49:58 up 659 days your server is vulnerable to a number of Xen security vulnerabilities: http://xenbits.xen.org/xsa/ Including this one from Oct 1, 2014 that allows guests to read up to 3KB of memory from the hypervisor or other guests: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7188 http://threatpost.com/serious-hypervisor-bug-fix-causes-unex...
That vulnerability only applies to HVM guests. No doubt there are other reasons to have rebooted since 2013, but if one of Rackspace's servers only has paravirtualized guests (do they use HVM at all? I don't know), they can get by without patching it.
Earlier quoted context omitted.
Yes, docker is immune to vulnerabilities because containers.
If the kernel you are running on is vulnerable, it can be attacked and the attacker can circumvent any container isolation. If the hypervisor (Xen!) running underneath your container-Linux is vulnerable, the attacker can get access to your virtualized OS and circumvent any container isolation.
Just received a message from Rackspace cloud regarding theses, it seems like they will have to reboot all instances. See https://community.rackspace.com/general/f/53/t/4978
Yet linode is still silent...
Just received a message from Rackspace cloud regarding theses, it seems like they will have to reboot all instances. See https://community.rackspace.com/general/f/53/t/4978
See ya later uptime... 04:49:58 up 659 days