Lessons Learned from Eight Years of Breaking Hypervisors
summary
Eight years of exploitation yields concrete lessons: dozens of real hypervisor bugs (first found in 2006) include Xen SA‑108 information leak via out‑of‑bounds read, VirtualBox shared‑folder flaws (UTF‑8/Unicode and path sanitization) and a kernel driver trusting shared memory pointers that enables local privilege escalation, device‑emulator heap overflows, and DeepSafe failing to enable DMA/vTD so a kernel exploit can corrupt hypervisor memory; proven mitigations: minimize host code, move drivers/emulators into VMs or service VMs, use DMA remapping and restrict boot‑time PCI access.
AI-written summary · about
chapters (24)
- 0:00Start
- 3:06Types of hypervisors, cntd
- 4:15Type 1&2 attack surface
- 12:17Functionality vs security
- 13:40What we compare to
- 19:21How can we compare cntd?
- 20:25Notes on exploitability...
- 24:32If virtualization is another layer...
- 27:13The state of the Union
- 27:42Case studies
- 29:40Shared folders
- 32:19How to exploit for code execution
- 33:01Lesson
- 33:36S0434968, cntd
- 35:34S0434947:Frontend to kernel escalation on the host
- 37:14CVE-2007-5497
- 38:08CVE-2011-1751
- 38:40Delusional boot
- 41:05CVE-2007-0069
- 42:11What to do with device emulation: stub domain
- 42:51Host as a service VM
- 47:19DMA attacks, VTd
- 49:30How to do arbitrary DMA (Windows)
- 54:20Questions?
related talks
54mPoacher Turned Gamekeeper: Lessons Learned from Eight Years of Breaking Hypervisors
56mA Retrospective Case Study of VMware Guest-to-Host Escape Vulnerabilities
53mXenpwn: Breaking Paravirtualized Devices
50mExploiting the Hyper-V IDE Emulator to Escape the Virtual Machine
22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVM
49mBreaking Hardware-Enforced Security With Hypervisors
51mAnalysis of the Attack Surface of Windows 10 Virtualization-Based Security
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...