On June 18th 2019 at 7pm CEST, 4 vulnerabilities have been disclosed affecting the TCP stack of the Linux kernel. These vulnerabilities relies on an integer overflow in the Linux kernel which can lead to a kernel panic on one hand, and on an algorithmic complexity in the SACK implementation leading to CPU resource exhaustion on the other hand. In both cases, the impact is limited to the service availability. Who is vulnerable ? All Linux Oses running a kernel 2.6.29 and above (from March 2009) FreeBSD 12 using the RACK TCP stack. Note that fortunately, this is not the default (...)
Blog Posts
On June 11th, security researchers published a paper titled “RAMBleed Reading Bits in Memory without Accessing Them”. This paper describes vector against Dynamic Random Access Memory (DRAM) modules that are already susceptible toRowhammer-style attacks. Systems using DRAM modules mitigated against Rowhammer style attacks remain protected from RAMBleed. This vector may affects hardware products, among which some used by OVH. This vulnerability has been referenced as: · CVE-2019-0174 According to the researchers, “RAMBleed’s rate of reading memory is modest, toping at around 3–4 bits per second. This allows sufficient time for memory scrubbing countermeasures to remove shortlived secret data from the target’s memory.“ At this point (...)
In 2018, we launched one of the largest projects in OVH’s history: migrating the 3 million websites hosted in our Paris datacentre. If you want to discover the reasons behind this titanic project, we took a look at them in this post. It is now time to explain how we proceeded with this project. We have already talked about our operational constraints, such as ensuring we’d no impact on the websites, even though we do not control the source code, and limiting the downtime. We also had many technical constraints, related to the architecture of our services. We’ll take a close look at (...)
En 2018, nous avons lancé l’un des plus gros projets de l’histoire d’OVH : migrer les 3 millions de sites web hébergés dans notre datacenter de Paris. Si vous souhaitez découvrir les raisons de ce projet titanesque, vous pouvez lire cet article. Il est désormais temps de vous expliquer comment nous avons procédé pour ce chantier. Nous avons déjà parlé de nos contraintes opérationnelles (ne pas avoir d’impact sur les sites web bien que nous ne maîtrisions pas le code source, limiter le temps d’indisponibilité…). Nous avons aussi de nombreuses contraintes techniques, liées à l’architecture de nos services. Avant de décrire nos (...)
Certains collaborateurs d’OVH ont lu un article paru ce mardi 4 juin dans le JDN, recueillant des témoignages anonymes d’anciens salariés et indiquant qu’on serait en train de lever le pied. Cet article et ces témoignages ont été ressentis comme une injustice. « Octave, je ne comprends pas cet article. Cela ne correspond pas à ce qu’on vit chez OVH. On bosse comme des fous chaque jour et ça ne fait que s’accélérer ! Tu dois répondre ! ». C’est donc d’abord pour nos équipes que j’ai décidé d’écrire ce blogpost. Pour tout vous dire, ça fait longtemps que je m’attends à (...)
If you’re reading this blog for the first time, welcome to the ongoing data revolution! Just after the industrial revolution came what we call the digital revolution, with millions of people and objects accessing a world wide network – the internet – all of them creating new content, new data. Let’s think about ourselves… We now have smartphones taking pictures and sending texts, sports watches collecting data about our health, Twitter and Instagram accounts generating content, and many other use cases. As a result, data in all its forms is exponentially exploding all over the world. 90% of the total (...)