Poacher Turned Gamekeeper: Lessons Learned from Eight Years of Breaking Hypervisors
summary
Eight years of breakage yields concrete fixes: three of four recent VirtualBox issues come from shared folders bugs — a non‑terminated path write, POSIX backslash directory traversal, and a host data leak — plus a host privilege escalation via shared struct mappings. Practical mitigations are small trusted host surfaces, offloading device logic to guests or PV drivers, delusional boot to revoke PCI access after boot, stub device domains, and mandatory VTD/IO‑MMU missing use because DMA proves a trivial way to overwrite a hypervisor and bypass integrity checks.
AI-written summary · about
chapters (20)
- 0:00Intro
- 2:46Types of hypervisors, cntd
- 4:02Type 1&2 attack surface
- 10:07What we compare to
- 11:49How can we compare?
- 14:20Notes on exploitability...
- 17:23If virtualization is another layer...
- 18:51The state of the Union
- 19:32Case studies
- 19:49Shared folders
- 23:20Lesson
- 28:14CVE-2007-5497
- 30:19Delusional boot
- 33:38guest PV driver
- 34:13CVE-2007-0069
- 35:13What to do with device emulation: stub domain
- 42:12DMA attacks, VTd
- 43:44How to do arbitrary DMA (Windows)
- 50:59Summary
- 51:39Questions?
related talks
55mLessons Learned from Eight Years of Breaking Hypervisors
56mA Retrospective Case Study of VMware Guest-to-Host Escape Vulnerabilities
53mXenpwn: Breaking Paravirtualized Devices
47mLinux Virtualization Based Security
22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVM
41mSecuring Your Xen-Based Cloud
12mSecurity and Performance in the Delegated User-level Virtualization
41mEscaping Virtualized Containers