Researchers find holes in virtualisation platforms

Powered by SC Magazine
 

Multiple platforms affected.

Researchers have discovered vulnerabilities in a series of virtualisation software platforms that allow attackers to gain unauthorised access.

The holes could be exploited to achieve local privileged escalation and virtual machine escapes on software from vendors Xen, FreeBSD, Microsoft, and RedHat running on 64-bit operating systems on Intel processors.

 

Invisible Things Lab principle researcher Rafal Wojtczuk discovered the flaws, which he said allowed a ring3 attacker to craft a stack frame to be executed by the kernel after a general protection exception.

US CERT’s Jared Allar issued an alert stating that “the fault will be handled before the stack switch, which means the exception handler will be run at ring0 with an attacker's chosen RSP causing a privilege escalation”.

VMware and AMD processors were not affected.

Users were urged to apply vendor patches. More detail is available on the US CERT advisory.

Copyright © SC Magazine, Australia


Researchers find holes in virtualisation platforms
 
 
 
Top Stories
The True Cost of BYOD - 2014 survey
Twelve months on from our first study, is BYOD a better proposition?
 
Photos: Unboxing the Magnus supercomputer
Pawsey's biggest beast slots into place.
 
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  28%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1121

Vote