Xen patches 7-year-old bug that shattered hypervisor security

[J65nko]

From http://arstechnica.com/security/2015...isor-security/ :

For seven years, Xen virtualization software used by Amazon Web Services and other cloud computing providers has contained a vulnerability that allowed attackers to break out of their confined accounts and access extremely sensitive parts of the underlying operating system. The bug, which some researchers say is probably the worst ever to hit the open source project, was finally made public Thursday along with a patch.

Further Reading
Extremely serious virtual machine bug threatens cloud providers everywhere

"Venom" allows attackers to break out of guest OS, escape into host. Patch now!
As a result of the bug, "malicious PV guest administrators can escalate privilege so as to control the whole system," Xen Project managers wrote in an advisory.

[rocket357]

Interesting...I seem to have overlooked the CVE number on that one.

Ahh, here's why:

https://aws.amazon.com/security/secu...ories-October/

No mention by CVE #.