PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Fuzzy Escape - A tale of vulnerability research on hypervisors

bughunters.google.com | research | #vulnerability-research | #fuzzing | #exploitation | #google | #hypervisor | #vm-escape
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The journey of discovering a VM escape bug in a hypervisor, demystifying the security research process and showing how persistence and pivoting lead to successful exploitation.
Published
Collected

Related coverage

research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · slcyber.io
How practical is 100k requests per second? Introducing h3fuzz
Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.
vulnerability · blog.quarkslab.com
Xen exploitation part 3: XSA-182, Qubes escape
Final part of the Xen exploitation series: discovering XSA-182 (CVE-2016-6258), a guest-to-host flaw in paravirtualized memory management, exploited on Qubes OS to seize dom0 from an untrusted VM.
vulnerability · pwn.ai
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)
How a $1 million sandbox challenge led pwn to a Linux CHECKSUM_PARTIAL trust-boundary bug: a post-validation IPv4 header mutation, a 32-byte host-memory disclosure, and an owned-host VM escape.
blog · projectzero.google
Pandavirtualization: Exploiting the Xen hypervisor
A Project Zero report on a Xen hypervisor escape: an attacker controlling a paravirtualized x86-64 guest kernel could break out and control physical memory, patched in April 2017.
research · bughunters.google.com
Changes to the Chrome VRP
Today we are announcing changes to the [Chrome Vulnerability Rewards Program](about/rules/chrome-friends/chrome-vulnerability-reward-program-rules), adjusting our reward amounts and program categories to reward deeper security research, recognize high-value fixes across more severity tiers, and provide new opportunities for researcher recognition.
Back