Organizer
Partner Company
qemu+kvm & xen pwn: virtual machine escape from 'Dark Portal'
Wei Xiao, Qinghao Tang
Qihoo 360
Abstract
QEMU+KVM and Xen now are both the widely-used system framework in cloud computing filed. Meanwhile, security risks is just like the shadow which always follow these system, bring severe damages. And the most serious security risk among them is controlling host machine by using malicious code inside virtual machine. We call it virtual machine escape attack.
By means of utilizing the “Dark Portal”(CVE-2016-3710) vulnerability found by 360 Marvel Team, we have successfully realized virtual machine escape attack under QEMU+KVM and Xen.
In this topic, we want to share following contents:
- Analysis of memory layout of QEMU process under QEMU+KVM environment and Xen environment.
- Principle of EIP／RIP control directly or indirectly.
- ShellCode placement by using information leakage vulnerability of QEMU.
- How to bypassing DEP and ALSR
- Other useful vulnerability exploitation methods.
- Full demo video and escape code.
Speaker Info
Wei Xiao , virtualization security researcher, 360 MarvelTeam, Qihoo 360, China Beijing Wei Xiao is the security researcher of 360 Marvel Team from Qihoo 360 Technology Co. Ltd , He has rich experience in cloud computing security . Additionally, he has found a considerable number of virtualization softwares vulnerabilities.
Qinghao Tang, virtualization security researcher, 360 MarvelTeam, Qihoo 360, China Beijing Qinghao Tang is the team leader of 360 Marvel Team from Qihoo 360 Technology Co. Ltd , He has rich experience in cloud computing security and linux kernel security . He was the speaker of Pacsec 2015 , Syscan 2016 and hitb 2016.