Virtualisation holes detailed on multiple platforms

Powered by SC Magazine
 

Local privileged escalation, virtual machine escapes possible.

Researchers have discovered vulnerabilities in a series of virtualisation software platforms that allow attackers to gain unauthorised access.

The holes could be exploited to achieve local privileged escalation and virtual machine escapes on software from vendors Xen, FreeBSD, Microsoft, and RedHat running on 64-bit operating systems on Intel processors.

Invisible Things Lab principle researcher Rafal Wojtczuk discovered the flaws, which he said allowed a ring3 attacker to craft a stack frame to be executed by the kernel after a general protection exception.

US CERT’s Jared Allar issued an alert stating that “the fault will be handled before the stack switch, which means the exception handler will be run at ring0 with an attacker's chosen RSP causing a privilege escalation”.

VMware and AMD processors were not affected.

Users were urged to apply vendor patches. More detail is available on the US CERT advisory.

Wojtczuk detailed the following ring3 attack steps:

  1. Map a frame at virtual address (1<<47)-4096
  2. Any method to set the target of sysret to a non-canonical address can potentially be used. This includes ptracesys_sigreturnsigactionexecve, possibly others. The best solution is to add a check for the address being non-canonical close before executing sysret. Note if the syscall handler ends with iret, then even if iret throws #GPrsp is not controlled by the attacker, and such the situation can be handled safely.
  3. Place a syscall instruction at address (1<<47)-2
  4. Place SOMETHING_MALICIOUS in general purpose registers
  5. Set rsp to AROUND_SOME_IMPORTANT_RING0_STRUCTURE
  6. Other scenarios are possible. Whenever the #GP handler runs with usermode rsp, or does not do swapgscorrectly, code execution may be possible.
  7. Jump to syscall instruction at (1<<47)-2

Copyright © SC Magazine, Australia


Virtualisation holes detailed on multiple platforms
 
 
 
Top Stories
Inside the stalemate on Australia's piracy code
Still not registered almost five months on.
 
IT staff outline deep anger in Macquarie Uni survey
‘Morale at lowest point in a decade’.
 
Cost blowout to push NBN past $41bn budget
But government funding cap to remain.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
New Windows 10 users, are you upgrading from...




   |   View results
Windows 8
  47%
 
Windows 7
  44%
 
Windows XP
  5%
 
Another operating system
  3%
 
Windows Vista
  2%
TOTAL VOTES: 704

Vote