---
title: "An important security notice regarding Spectre and Meltdown"
description: "An important security notice regarding Spectre and Meltdown"
date: 2018-01-04
author: "Pierre-Yves Ritschard"
url: https://www.exoscale.com/blog/spectre-and-meltdown/
---
# An important security notice regarding Spectre and Meltdown

As you most likely have heard, two important security advisories were
released this week.  These vulnerabilities have been dubbed Spectre and
Meltdown. They have both been independently found by several parties,
including [Google's project
zero](https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html)
and the [University of Graz](https://meltdownattack.com/).

The following relevant CVEs have been created:

- CVE-2017-5753
- CVE-2017-5715
- CVE-2017-5754

These attacks are feasible on Intel processors such as the ones
Exoscale relies on.  The attack variants that are specific to Xen
Paravirtualization or single-kernel solutions such as containers do
not impact Exoscale.  The potential security impact remains critical.

To ensure the vulnerabilities can not be exploited on Exoscale, we are
currently testing Linux kernels containing software mitigations.
Once we are confident that no regression will occur, we will roll-out
the update to all hypervisors which will incur a reboot of your
Exoscale instances.

We will keep you informed of our maintenance schedule and will do our
best to keep disruptions to a minimum.

Customers relying on [dedicated
hypervisors](https://www.exoscale.com/virtual-private-cloud/) will also
be part of the scheduled hypervisor reboot roll-out but are free of
potential malicious neighbor attacks.

Should you need any additional detail, reach us through support. If
you need to divulge any sensitive information, you may follow the
procedure described in our
[Security](https://www.exoscale.com/security/) page.

### What should you do?

As a customer, you are still responsible for keeping your system up to date.
Depending on your instance type, updates may or may not already be available.

Please refer to your operating system vendor for additional information.
For reference, here are links to the appropriate vendor pages for our
most used OS templates:

#### Ubuntu

- https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5715.html
- https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5753.html
- https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5754.html

#### Windows

- https://support.microsoft.com/en-us/topic/kb4072698-windows-server-and-azure-stack-hci-guidance-to-protect-against-silicon-based-microarchitectural-and-speculative-execution-side-channel-vulnerabilities-2f965763-00e2-8f98-b632-0d96f30c8c8e

#### Redhat and CentOS

- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-5715
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-5753
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-5754