AWS Statement: Processor Speculative Execution Research Disclosure (opens in new tab)

Agreed. Also this:

>All but a small single-digit percentage of instances across the Amazon EC2 fleet are already protected.

As of when?

Goes on to say that the "underlying infrastructure" is protected, but OS patches are required. What does it mean that instance infrastructure is protected, but the OS is not, and which step would introduce the performance degradation?

The vulnerabilities affect multiple layers in a virtualized environment. Amazon patching the virtualization host is what would prevent things like guests reading host memory (essentially a guest escape - one VM gaining access to other VMs running on the same system). Patching the guest VM is what's needed to mitigate other attack vectors (like unprivileged code reading kernel memory).

I don't think updated packages are available for any of the major distributions as of now. So far I've only seen fixed packages for Amazon Linux and Google's Container-Optimized OS.

They have a wiki article now, https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAn...

I did on first attempt to load it, then it worked on an immediate refresh. Probably a cold cache or something.