Spectre/Meltdown impact on network devices
Masataka Ohta
mohta at necom830.hpcl.titech.ac.jp
Mon Jan 8 09:49:34 UTC 2018
Jason Gmail wrote:
> The only business I've been looking at is AWS
>
> https://aws.amazon.com/security/security-bulletins/AWS-2018-013/
It merely says:
All instances across the Amazon EC2 fleet are protected from
all known threat vectors from the CVEs previously listed.
not spectre in general.
But, as mentioned in:
https://access.redhat.com/security/cve/cve-2017-5715
It relies on the presence of a precisely-defined instruction
sequence in the privileged code
and
https://access.redhat.com/security/cve/cve-2017-5753
It relies on the presence of a precisely-defined instruction
sequence in the privileged code
CVEs previously listed are spectre attacks between privileged and
unprivileged codes, which means spectre attack between
unprivileged codes is still possible with AWS, which is why
we should avoid cloud servers, until CPU hardware is fixed.
Masataka Ohta
More information about the NANOG
mailing list