Posted on 14.5.2015

UpCloud and VENOM, CVE-2015-3456, Security Vulnerability

Yesterday, on Wednesday 13th, 2015, Crowdstrike announced information regarding a security vulnerability they had discovered in the floppy disk controller on QEMU. The vulnerability allows an attacker to escape the confinement of the Virtual Machine guest operating system and gain privileged access to the host machine.

Since a key component of security in virtualised environments is the ability to limit access to guest operating systems only, patching this vulnerability was of major importance immediately when we saw it.

Last night, at around 17.30 UTC, we informed all our customers via e-mail about the patching process that would begin later that night at 19.00 UTC. We did not want to publicly announce anything since this would have given notice to potential exploiters as well. This morning, at 6:28 UTC, all UpCloud’s host machines in all three service areas had been patched.

While this project was enormous given such a short time frame, with the forced security updates we were able to migrate all customers to updated host machines. We were able to decommission, in an accelerated fashion, a large number of older host machines resulting in better performance and reliability for our customers at large.

The CVE-2015-3456 advisory is not an issue on UpCloud anymore and we want to thank our customers for co-operating with us on such a short notice. We continue to monitor all announcements and advisories regarding the different components we use in our infrastructure to keep our service as secure as possible.

Joel Pihlajamaa

Leave a Reply

Your email address will not be published. Required fields are marked *

Bigger Is Not Necessary Better: AWS vs. UpCloud

One of the most common questions our customers ask us is that how we can compete with the likes of Amazon Web Services (AWS) on price as they have economies of scale on their side.

Comparisons

UpCloud and Montel – Partnership to bring Kubernetes to Cloud Natives

UpCloud partner programme member and software company, Montel Intergalactic, delivers DevOps expertise to clients across all parts of the software lifecycle and creates future-proof cloud infrastructure for clients on UpCloud. We spoke to Lauri Kainulainen, CTO of Montel, to explore how beneficial a tight-knit partnership is for cloud computing, and why the businesses who switch […]

Industry analyses

Vision and culture

UpCloud’s development roadmap: What to look forward to in 2021

The year has turned, and UpCloud welcomes you to 2021, ready again to show you what the best cloud infrastructure can offer for your business. The last year has proven the capabilities of our brand, products and most importantly, the strength of our teams. We’ve been happy to see many new users coming and staying […]

Announcements

Vision and culture

Back to top