Xen Project Spectre/Meltdown FAQ
Google’s Project Zero announced several information leak vulnerabilities affecting all modern superscalar processors. Details can be found on their blog, and in the Xen Project Advisory 254. To help our users understand the impact and our next steps forward, we put together the following FAQ.
Note that we will update the FAQ as new information surfaces.
Is Xen impacted by Meltdown and Spectre?
There are two angles to consider for this question:
- Can an untrusted guest attack the hypervisor using Meltdown or Spectre?
- Can a guest user-space program attack a guest kernel using Meltdown or Spectre?
Systems running Xen, like all operating systems and hypervisors, are potentially affected by Spectre (referred to as SP1 and SP2 in Advisory 254). For Arm Processors information, you can find which processors are impacted here. In general, both the hypervisor and a guest kernel are vulnerable to attack via SP1 and SP2.
Only Intel processors are impacted by Meltdown (referred to as SP3 in Advisory 254). On Intel processors, only 64-bit PV mode guests can attack Xen. Guests running in 32-bit PV mode, HVM mode, and PVH mode cannot attack the hypervisor using SP3. However, in 32-bit PV mode, HVM mode, and PVH mode, guest userspaces can attack guest kernels using SP3; so updating guest kernels is advisable.
Read the entire article here, Xen Project Spectre/Meltdown FAQ | Xen Project Blog
Via the fine folks at Xen.org.