Sharing research and discoveries at PWN2OWN

The annual PWN2OWN exploit contest at the CanSecWest conference in Vancouver, British Columbia, Canada, brings together some of the top security talent from across the globe in a friendly competition. For the participants, these events are a platform to demonstrate world-class skills and vie for...

Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch

The xhciringfetch function in hw/usb/hcd-xhci.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash by leveraging failure to limit the number of link Transfer Request Blocks TRB to process...

UBUNTU-CVE-2017-10918

Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obtain privileged host OS access, aka XSA-222...

DEBIAN-CVE-2016-10013

Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation...

Oracle VM VirtualBox Remote Vulnerability

Oracle Virtualization Oracle VirtualBox is a virtual machine component of Oracle's virtualization solution. A security vulnerability exists in the GUI subcomponent of the Oracle VM VirtualBox component in Oracle Virtualization. An attacker could exploit this vulnerability to compromise the...

DEBIAN-CVE-2016-6836

The vmxnet3completepacket function in hw/net/vmxnet3.c in QEMU aka Quick Emulator allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcqdescr object...

Xen Denial of Service Vulnerability (CNVD-2016-12158)

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. Xen has a denial of service...

USN-3047-1 qemu, qemu-kvm vulnerabilities

Li Qiang discovered that QEMU incorrectly handled 53C9X Fast SCSI controller emulation. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In the default installation, when QEMU is...

virt: guest to host DoS by triggering an infinite loop in microcode via #AC exception

It was found that the x86 ISA Instruction Set Architecture is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way sequential delivering of benign exceptions such as AC alignment check exception is handled. A privileg...

The vulnerability of Hyper-V software allows a malicious actor to trigger a service failure.

The Hyper-V component of the Windows operating system contains a vulnerability related to errors that occur when a specially crafted application is launched on a virtual machine. Exploiting this vulnerability can allow an attacker to cause a failure in the virtual machine controller...

DEBIAN-CVE-2014-6540

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.1.34, before 4.2.26, and before 4.3.14 allows local users to affect availability via vectors related to Graphics driver WDDM for Windows guests...

DEBIAN-CVE-2013-2140

The dispatchdiscardio function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation in the Linux kernel before 3.10.5 allows guest OS users to cause a denial of service data loss via filesystem write operations on a read-only disk that supports the 1 BLKIFOPDISCARD aka discard...

virt: VT-d (PCI passthrough) MSI trap injection

Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges by "using DMA to generate MSI interrupts by writing to the interrupt injection registers."...

DEBIAN-CVE-2010-2239

Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the host OS via unspecified vectors...

Security Risks Abound in Virtualized Environments

Through 2012, 60 percent of virtualized servers will be less secure than the physical servers they replace, according to Gartner. Although they expect this figure to fall to 30 percent by the end of 2015, analysts warned that many virtualization deployment projects are being undertaken without...

Q&A: Chris Hoff on cloud computing

Chris Hoff, the former chief security architect at Unisys and the author of the consistently insightful and funny Rational Survivability blog, is among the most sought-after speakers in the security industry and an authority on cloud computing and virtualization security. In this interview, he...

Chris Hoff on the Cloud Security Alliance, Virtualization Security and Cage Matches

Dennis Fisher talks to Chris Hoff, author of the Rational Survivability blog and well-known speaker on cloud security and virtualization security issues. Download Subscribe to the Digital Underground podcast on...

Paper: Adventures with a certain Xen vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Invisible Things Lab is proud to present: "Adventures with a certain Xen vulnerability in the PVFB backend" by Rafal Wojtczuk Starring Xen 3.2.0, DomU an ordinary virtual machine, paravirtualized, Dom0 privileged administrative domain running on FC8...