Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Pandavirtualization: Exploiting the Xen hypervisor

projectzero.google | blog | #virtualization | #hypervisor | #vm-escape | #project-zero | #xen | #x86-64

Summary

A Project Zero report on a Xen hypervisor escape: an attacker controlling a paravirtualized x86-64 guest kernel could break out and control physical memory, patched in April 2017.
Published
Collected

original ↗

Related coverage

vulnerability · theori.io
Compromising virtualization without attacking the hypervisor
CVE-2020-27675 (XSA-331): a DoS and potential out-of-bounds write in Linux's Xen paravirtualization driver — how virtualization platforms can be compromised without attacking the hypervisor directly.
vulnerability · blog.quarkslab.com
Xen exploitation part 3: XSA-182, Qubes escape
Final part of the Xen exploitation series: discovering XSA-182 (CVE-2016-6258), a guest-to-host flaw in paravirtualized memory management, exploited on Qubes OS to seize dom0 from an untrusted VM.
blog · netspi.com
Virtualization Security Resources
A starter collection of virtualization security resources: hardening guides for Hyper-V, VMware vSphere, and Xen, plus references from DISA STIG, CSA, SANS, and CIS.
research · bughunters.google.com
A Fuzzy Escape - A tale of vulnerability research on hypervisors
The journey of discovering a VM escape bug in a hypervisor, demystifying the security research process and showing how persistence and pivoting lead to successful exploitation.
research · blog.quarkslab.com
On the fly virtualization with Cappsule
Releasing Cappsule under GPLv2: a small hypervisor that virtualizes any Linux app on the fly into lightweight VMs starting on the running kernel, confining attacks with no disk image or OS changes.
advisory · blog.quarkslab.com
Xen exploitation part 2: XSA-148, from guest to host
Exploiting Xen XSA-148 (CVE-2015-7835): a page-table bug lets x86 paravirtualized guests execute arbitrary code in dom0; explains the vulnerability and develops a full working exploit.
back