Holes found in multiple virtualisation platforms

By Darren Pauli on Jun 15, 2012 7:43 AM
Filed under Security

Local privileged escalation, virtual machine escapes possible.

Researchers have discovered vulnerabilities in a series of virtualisation software platforms that allow attackers to gain unauthorised access.

The holes could be exploited to achieve local privileged escalation and virtual machine escapes on software from vendors Xen, FreeBSD, Microsoft, and RedHat running on 64-bit operating systems on Intel processors.

Invisible Things Lab principle researcher Rafal Wojtczuk discovered the flaws, which he said allowed a ring3 attacker to craft a stack frame to be executed by the kernel after a general protection exception.

US CERT’s Jared Allar issued an alert stating that “the fault will be handled before the stack switch, which means the exception handler will be run at ring0 with an attacker's chosen RSP causing a privilege escalation”.

VMware and AMD processors were not affected.

Users were urged to apply vendor patches. More detail is available on the US CERT advisory.

Wojtczuk detailed the following ring3 attack steps:

  1. Map a frame at virtual address (1<<47)-4096
  2. Any method to set the target of sysret to a non-canonical address can potentially be used. This includes ptracesys_sigreturnsigactionexecve, possibly others. The best solution is to add a check for the address being non-canonical close before executing sysret. Note if the syscall handler ends with iret, then even if iret throws #GPrsp is not controlled by the attacker, and such the situation can be handled safely.
  3. Place a syscall instruction at address (1<<47)-2
  4. Place SOMETHING_MALICIOUS in general purpose registers
  5. Set rsp to AROUND_SOME_IMPORTANT_RING0_STRUCTURE
  6. Other scenarios are possible. Whenever the #GP handler runs with usermode rsp, or does not do swapgscorrectly, code execution may be possible.
  7. Jump to syscall instruction at (1<<47)-2
 
Follow us on Facebook and Twitter
 

Copyright © SC Magazine, Australia

Holes found in multiple virtualisation platforms
 
 
 
 
 
Top Stories
Datacom signs mega data centre deal with NextDC
Perth is first cab off the rank.
 
NewLease hires former MYOB and Oracle man as new CEO
Following death of co-founder Douglas Tutus.
 
Aussie firm aims to build 10,000-strong software army
Revolution IT banks on crowdsourcing to help win business.
 
Sign up to receive CRN email bulletins
   FOLLOW US...
Polls
Which mobile device couldn't you live without?


Latest Comments
CRN Magazine

Issue: 329 | July 2014

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.