Virtualisation holes detailed on multiple platforms

Powered by SC Magazine
 

Local privileged escalation, virtual machine escapes possible.

Researchers have discovered vulnerabilities in a series of virtualisation software platforms that allow attackers to gain unauthorised access.

The holes could be exploited to achieve local privileged escalation and virtual machine escapes on software from vendors Xen, FreeBSD, Microsoft, and RedHat running on 64-bit operating systems on Intel processors.

Invisible Things Lab principle researcher Rafal Wojtczuk discovered the flaws, which he said allowed a ring3 attacker to craft a stack frame to be executed by the kernel after a general protection exception.

US CERT’s Jared Allar issued an alert stating that “the fault will be handled before the stack switch, which means the exception handler will be run at ring0 with an attacker's chosen RSP causing a privilege escalation”.

VMware and AMD processors were not affected.

Users were urged to apply vendor patches. More detail is available on the US CERT advisory.

Wojtczuk detailed the following ring3 attack steps:

  1. Map a frame at virtual address (1<<47)-4096
  2. Any method to set the target of sysret to a non-canonical address can potentially be used. This includes ptracesys_sigreturnsigactionexecve, possibly others. The best solution is to add a check for the address being non-canonical close before executing sysret. Note if the syscall handler ends with iret, then even if iret throws #GPrsp is not controlled by the attacker, and such the situation can be handled safely.
  3. Place a syscall instruction at address (1<<47)-2
  4. Place SOMETHING_MALICIOUS in general purpose registers
  5. Set rsp to AROUND_SOME_IMPORTANT_RING0_STRUCTURE
  6. Other scenarios are possible. Whenever the #GP handler runs with usermode rsp, or does not do swapgscorrectly, code execution may be possible.
  7. Jump to syscall instruction at (1<<47)-2

Copyright © SC Magazine, Australia


Virtualisation holes detailed on multiple platforms
 
 
 
Top Stories
Parliament passes law to let ASIO tap entire internet
Greens effort to limit devices fails.
 
Business-focused Windows 10 brings back the Start menu
Microsoft skips 9 for the "greatest enterprise platform ever".
 
Feeling Shellshocked?
Stay up to date with patching for the Bash bug.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  65%
 
Advanced persistent threats
  5%
 
Unpatched or unsupported software vulnerabilities
  11%
 
Denial of service attacks
  6%
 
Insider threats
  12%
TOTAL VOTES: 1388

Vote