SideChannelAttack on L3-Cache allows VM to read host/other VMs data

[Frazze]

You can read all about it here:

http://eprint.iacr.org/2013/448.pdf

Short summary: On Intel CPUs starting from i-2000 generation (Sandy Bridge) and maybe also some AMD CPUs with shared L3-Cache (or LLC, Last-Level-Cache) it is possible for a VM to read data which normaly should not be accessible to the VM (like host's data or other VM's data).

Disabling memory de-duplication seems to fix the problem.


Just to let people know, it's not really Proxmox related, but makes sense to post here IMHO.

 

[mir]

Disabling memory de-duplication comes with a cost. Each VM will then hold an identical set of common code which means increased total memory consumption and therefore your maximum number of concurrent running VM's decreases.

 

[Frazze]

Of course it does. I am just posting one possible solution. maybe there are others, but I don't know of any others