AWS recently published AWS Security Bulletin AWS-2018-013 for the newly disclosed research regarding side-channel analysis via speculative execution on modern computer processors. This bulletin refers to three security advisories: CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754. These advisories are based on research from Google Project Zero that identified new methods for side-channel analysis in modern computer processors. Because these methods target foundational technology, namely speculative execution, that is part of many manufacturers’ processors, this research has wide-reaching implications: from hypervisors to operating systems to web browsers, and from your phone to servers running in datacenters that make up the cloud.
EC2 instance isolation
All instances across the Amazon EC2 fleet are protected from all known instance-to-host and instance-to-instance concerns of the CVEs previously listed. Instance-to-instance concerns assume an untrusted neighbor instance could read the memory of another instance or the AWS hypervisor. This issue has been addressed for AWS hypervisors, and no instance can read the memory of another instance, nor can any instance read AWS hypervisor memory. We have not observed meaningful performance impact for the overwhelming majority of EC2 workloads.
Operating system patches
Modern operating systems have multiple types of process isolation, including isolating the kernel from “userspace” processes, and isolating processes from each other. All three of the disclosed issues can have an impact on process isolation in any setting where an operating system is running on the affected processors. The protections implemented in a hypervisor do not extend to the process-level isolation within an operating system, therefore operating system patches are required to mitigate risks.
It is important to note that there are no operating system level protections to address process-to-process concerns of CVE-2017-5754 for paravirtualization (PV) instances. While PV instances are protected by AWS hypervisors from any instance-to-instance concerns as described above, customers concerned with process isolation within their PV instances (e.g. process untrusted data, run untrusted code, host untrusted users), are strongly encouraged to migrate to HVM instance types for longer-term security benefits. For more information on the differences between PV and HVM (as well as instance upgrade path documentation), please see: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/virtualization_types.html
We strongly recommend that customers patch their instance operating systems to isolate software running within the same instance and mitigate process-to-process concerns of CVE-2017-5754.
Customers using AWS Systems Manager can use Patch Manager to maintain security and compliance by setting up patch rules, updating their instances, and viewing compliance. Alternatively, customers can use Run Command for directly updating their instances with rate control. More details are available at: https://forums.aws.amazon.com/ann.jspa?annID=5351
Below are patching details for the following operating systems: