Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Anybody knows what this 10% mean? I mean :

a) only 10% of the fleet are running a version of the hypervisor that is affected by the bug

b) based on the turnover rate, they expect 10% to need rebooting under the customers by the date the bugs are being released.

c) 10% are running a combination of the affected hypervisor and vm's that are reasonably at risk of exploitation, other's may have the faulty hypervisor but either are being used as single tenant (there is no risk of someone breaking out and affecting someone else) or are running vm's that may not be able to break out depending on the nature of bugs.

Just speculating, any ideas?



In the past, Xen has has vulnerabilities based on things different between Intel and AMD processors, or even between different processors from the same company. It seems likely that the fleet is all running the same version of the hypervisor, but the bug only matters on 10% of their hardware.

Here's a previous Xen vulnerability based on Intel implementing the SYSRET instruction (originally introduced by AMD, along with SYSCALL; Intel's version of this was SYSENTER and SYSEXIT, with different semantics about kernel stacks and things) in a slightly different way from how AMD implemented it. Both Intel's docs and AMD's docs were accurate for their own processors, but if you only read AMD's docs, you'd implement syscalls in a way that was vulnerable on Intel.

https://blog.xenproject.org/2012/06/13/the-intel-sysret-priv...


In this case, as is explained in the post, the reason it is only 10% is because the newer hardware can be upgraded without requiring a reboot.


They explain this in the second paragraph.


d) All of the machines require the patch, but on 90% they have already applied it with no need to reboot.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: