Virtualisation holes detailed on multiple platforms

By on
Virtualisation holes detailed on multiple platforms

Local privileged escalation, virtual machine escapes possible.

Researchers have discovered vulnerabilities in a series of virtualisation software platforms that allow attackers to gain unauthorised access.

The holes could be exploited to achieve local privileged escalation and virtual machine escapes on software from vendors Xen, FreeBSD, Microsoft, and RedHat running on 64-bit operating systems on Intel processors.

Invisible Things Lab principle researcher Rafal Wojtczuk discovered the flaws, which he said allowed a ring3 attacker to craft a stack frame to be executed by the kernel after a general protection exception.

US CERT’s Jared Allar issued an alert stating that “the fault will be handled before the stack switch, which means the exception handler will be run at ring0 with an attacker's chosen RSP causing a privilege escalation”.

VMware and AMD processors were not affected.

Users were urged to apply vendor patches. More detail is available on the US CERT advisory.

Wojtczuk detailed the following ring3 attack steps:

  1. Map a frame at virtual address (1<<47)-4096
  2. Any method to set the target of sysret to a non-canonical address can potentially be used. This includes ptracesys_sigreturnsigactionexecve, possibly others. The best solution is to add a check for the address being non-canonical close before executing sysret. Note if the syscall handler ends with iret, then even if iret throws #GPrsp is not controlled by the attacker, and such the situation can be handled safely.
  3. Place a syscall instruction at address (1<<47)-2
  4. Place SOMETHING_MALICIOUS in general purpose registers
  5. Set rsp to AROUND_SOME_IMPORTANT_RING0_STRUCTURE
  6. Other scenarios are possible. Whenever the #GP handler runs with usermode rsp, or does not do swapgscorrectly, code execution may be possible.
  7. Jump to syscall instruction at (1<<47)-2

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
Flash is heading towards its grave, and that's...
Great! Good riddance
Sad! Flash had some good qualities
Irrelevant. I don't care
What's Flash?
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?