Comment by j_s - Hacker Neue

j_s Apr 28, 2017 parent

Thanks for the follow-up! I'll settle for "no tier-1 US provider publicly admits to using QEMU". :)

I didn't dig too far into the AWS vulnerability list to try to find QEMU; XEN shows up right away! Ok: QEMU is last mentioned July 2015, and in none of the mentions is AWS vulnerable.

https://www.google.com/?q=site:https://aws.amazon.com/securi...

bonzini Apr 28, 2017

> and in none of the mentions is AWS vulnerable.

Yep, that's because most bugs are found in legacy devices that are never found in production. The big exception was a buffer overflow in the floppy device emulation (the "VENOM" vulnerability).

A lot of AWS security bulletins say "AWS customers' data and instances are not affected by these issues". I read it as "we knew about it a couple weeks in advance and have done a rolling upgrade". :)

This item has no comments currently.