PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2020-27675] Compromising virtualization without attacking the hypervisor

theori.io | vulnerability | CVE-2020-27675 | #linux-kernel | #virtualization | #hypervisor | #xen | #cve-2020-27675 | #xsa-331
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2020-27675 (XSA-331): a DoS and potential out-of-bounds write in Linux's Xen paravirtualization driver — how virtualization platforms can be compromised without attacking the hypervisor directly.
CVE
CVE-2020-27675
Published
Collected

Related coverage

blog · projectzero.google
Pandavirtualization: Exploiting the Xen hypervisor
A Project Zero report on a Xen hypervisor escape: an attacker controlling a paravirtualized x86-64 guest kernel could break out and control physical memory, patched in April 2017.
vulnerability · blog.quarkslab.com
Xen exploitation part 3: XSA-182, Qubes escape
Final part of the Xen exploitation series: discovering XSA-182 (CVE-2016-6258), a guest-to-host flaw in paravirtualized memory management, exploited on Qubes OS to seize dom0 from an untrusted VM.
research · blog.quarkslab.com
On the fly virtualization with Cappsule
Releasing Cappsule under GPLv2: a small hypervisor that virtualizes any Linux app on the fly into lightweight VMs starting on the running kernel, confining attacks with no disk image or OS changes.
blog · netspi.com
Virtualization Security Resources
A starter collection of virtualization security resources: hardening guides for Hyper-V, VMware vSphere, and Xen, plus references from DISA STIG, CSA, SANS, and CIS.
vulnerability · theori.io
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)
A deep dive into CVE-2024-27394, a TCP-AO use-after-free caused by incorrect RCU API usage in the Linux kernel, covering RCU internals, the patch, and the ExpRace technique for reliable triggering.
vulnerability · theori.io
Linux Kernel Exploit (CVE-2022–32250) with mqueue
Exploiting CVE-2022-32250, a Netfilter nftables use-after-free write, to root Ubuntu 22.04: heap and KASLR leaks with mqueue, a modprobe_path overwrite, plus root-cause analysis and patch.
Back