Xen Hypervisor VM Escape

51 Pages·2016·1.9 MB·English

by  Shangcong Luan

Advanced Exploitation:
Xen Hypervisor VM Escape
ShangcongLuan
May27,2016
AlibabaCloudPlatformSecurityTeam
1
Who am I?
2014-2015 at Vulnhunt Security Team for APT Defense
2015-now at Alibaba Cloud Platform Security Team for Cloud
Security
Twitter: @hikerell
2
Agenda
1. Introduction
2. XSA-148/CVE-2015-7835
3. Exploitation Technologies
4. The End
5. Demo Time
3
Introduction
The Xen Project
“The XenProjectTM is the leadingopen source
virtualization platformthat is poweringsome of the
largestcloudsin productiontoday. ”
fromxenproject.org
4
Xen Architecture
5
Xen Hypervisor
• CPU Scheduling
• Memory Management
• VM Executation
• ...
6
Xen Domain
Dom0:
• Privileged Domain
• Control Other Domains
domU:
• Dom1, Dom2, Dom3 ...
• Unprivileged Domains
7
Xen Domains Running Mode
PVM:
• paravirtualization machine
• modified OS kernel
HVM:
• hardware-assisted virtualization machine
• unmodified OS kernel
• CPU/MMU => hardware assistance
8
Xen Memory Management
x86 Paravirtualised Memory Management:
Direct Paging
9