Pair of bug reports show how VM escapes put servers at risk

guest · Sep 16, 2019

Vulnerability Spotlight: AMD ATI Radeon ATIDXX64.DLL shader functionality remote code execution vulnerability
September 16, 2019
https://blog.talosintelligence.com/2019/09/vuln-spotlight-AMD-Radeon-ATI-sept-19.html

Some AMD Radeon cards contain a remote code execution vulnerability in their ATIDXX64.DLL driver. AMD produces the Radeon line of hardware, which includes graphics cards and graphics processing units. This specific vulnerability exists on the Radeon RX 550 and the 550 Series while running VMWare Workstation 15.
An attacker could exploit this vulnerability by supplying a malformed pixel shared inside the VMware guest operating system to the driver. This could corrupt memory in a way that would allow the attacker to gain the ability to remotely execute code on the victim machine.

In accordance with our coordinated disclosure policy, Cisco Talos worked with AMD to ensure that these issues are resolved and that an update is available for affected customers.
Click to expand...

guest · Sep 18, 2019

Pair of bug reports show how VM escapes put servers at risk
September 18, 2019
https://www.theregister.co.uk/2019/09/18/vmware_amd_hypervisor_escapes/

CVE-2019-14835 was discovered and reported by Peter Pi, a member of the Tencent Blade Team. It is found in the Linux kernel versions 2.6.34 up to version 5.3, where it is patched.

The flaw itself is found in Qemu-KVM, an open-source environment typically used to host virtual machines on Linux servers. Pi found that when the host server performs a migration to another machine, Qemu accesses a table in memory that the guest VM can write to.
As the summary notes, actually exposing the bug requires being able to trigger a migration, meaning the attack would either have to chain with another exploit or have some fairly detailed knowledge of the host server, making the real-world risk from the flaw slightly less.

Still, admins would be well advised to update the kernel on their Linux servers in order to get this and other bug fixes.
Click to expand...

Meanwhile, with VMware and AMD...
Piotr Bania and Cisco Talos took credit for discovery of CVE-2019-5049.
It can be exploited by Windows 10 virtual machines to break out of VMware Workstation. Thus, if you're hosting Windows 10 guests with these drivers present, you're at risk.
Click to expand...

guest · Sep 18, 2019

mood said: ↑

Vulnerability Spotlight: AMD ATI Radeon ATIDXX64.DLL shader functionality remote code execution vulnerability
Click to expand...

AMD Display Driver Security Updates address CVE-2019-5685
September 17, 2019
https://blogs.vmware.com/security/2...r-security-updates-address-cve-2019-5685.html

We wanted to make you aware that AMD has released a security bulletin entitled ‘Shader Functionality Remote Code Execution‘ which documents remediation for CVE-2019-5049.

This vulnerability has been shown to affect VMware Workstation and, as the article mentions, updated graphics drivers are available on the AMD support page.
Customers should review the available documentation and direct technical inquiries to VMware Support for further assistance.
Click to expand...

guest · Jan 23, 2020

AMD patches critical vulnerabilities in its Radeon graphics cards
January 22, 2020
https://hotforsecurity.bitdefender....ities-in-its-radeon-graphics-cards-22163.html

The research team from Cisco Talos has spotted four exploitable vulnerabilities in AMD ATIDXX64.DLL driver that can affect VMware Workstation running on Windows, according to recent Talos Vulnerability reports.

The security issues, tracked as CVE-2019-5124, CVE-2019-5146, CVE-2019-5147 and CVE-2019-5183, were tested on Radeon RX 550 / 550 Series VMware Workstation 15 (15.5.0 build-14665864) with Windows 10 x64 as guestVM. The researchers concluded that a threat actor could perform a denial of service (DoS) attack or allow for remote execution of arbitrary code on a targeted system.

The research team mentioned that all vulnerabilities pose a high security risk as a remote non-authenticated attacker can exploit them. Neither Talos nor AMD are aware of exploitation of the flaws.
Click to expand...

mirimir · Jan 23, 2020

I'm no expert, but I suspect that giving VMs direct access to the graphics card (for better performance) is the problem.

guest · Jan 27, 2020

mood said: ↑

AMD patches critical vulnerabilities in its Radeon graphics cards
January 22, 2020
Click to expand...

VMware Warns Over AMD Driver Vulnerabilities
January 27, 2020
https://www.cbronline.com/cybersecurity/threats/amd-driver-vulnerability/

Security researchers at Cisco Talos say they have identified a range of serious vulnerabilities in AMD firmware that could be remotely exploited by a non-authenticated attacker, potentially giving access to VMware workstations.
The first AMD driver vulnerability, CVE-2019-5183, comes with a critical CVSS score of 9.0. In a unique attack, Bania created a “specially crafted pixel shader” (a method of rendering graphical features) to exploit the bug.

VMware’s security response centre told customers today: “We wanted to make you aware of multiple AMD security issues.. these have been shown to affect VMware Workstation running on Windows.” It urged users to patch.
Click to expand...

guest · Mar 14, 2020

VMware fixes a critical bug in Workstation, Fusion that allows code execution on host From guest
March 13, 2020
https://securityaffairs.co/wordpress/99578/security/vmware-workstation-critical-bug.html

VMware has addressed three serious vulnerabilities in its products, including a critical flaw in Workstation and Fusion that could be exploited to execute code on the host from guest.

The critical vulnerability, tracked as CVE-2020-3947, is a use-after-free flaw in the component, it has received a CVSSv3 base score of 9.3.

“VMware Workstation and Fusion contain a use-after vulnerability in vmnetdhcp.VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3.” reads the advisory published by VMWare.
“Successful exploitation of this issue may lead to code execution on the host from the guest or may allow attackers to create a denial-of-service condition of the vmnetdhcp service running on the host machine.”

“Local attackers with non-administrative access to a Linux guest VM with VMware Tools installed may exploit this issue to elevate their privileges to root on the same guest VM.””
Click to expand...

guest · Jun 24, 2020

VMware fixes critical vulnerability in Workstation and Fusion
June 24, 2020
https://www.bleepingcomputer.com/ne...ical-vulnerability-in-workstation-and-fusion/

VMware released security updates to fix multiple vulnerabilities in VMware ESXi, Workstation, and Fusion, with one of them being a critical bug in default configurations of Workstation and Fusion having 3D graphics enabled.
Critical vulnerability with a 9.3 CVSSv3 base score
The critical security issue tracked as CVE-2020-3962 is a use-after-free flaw in the SVGA device that could allow local attackers to execute arbitrary code on the hypervisor from a virtual machine after successful exploitation.

To block attacks designed to abuse this vulnerability, VMware Workstation (Pro and Player) and VMware Fusion (Pro) users are advised to immediately upgrade to version 15.5.5, while VMware ESXi customers should update to ESXi_7.0.0-1.20.16321839, ESXi670-202004101-SG, or ESXi650-202005401-SG.
Click to expand...

VMware fixed nine other security vulnerabilities [...]
After successfully exploiting these flaws, attackers with local access to a virtual machine (with admin privileges in some cases) could execute code on the hypervisor from the VM, trigger a denial-of-service (DoS) condition, read privileged info in the hypervisor's memory or in physical memory.

In some cases, "[a]dditional conditions beyond the attacker's control must be present for exploitation to be possible" according to VMware's advisory.
Click to expand...

Log in or Sign up

Pair of bug reports show how VM escapes put servers at risk

guest Guest

guest Guest

guest Guest

guest Guest

mirimir Registered Member

guest Guest

guest Guest

guest Guest

Log in or Sign up

Pair of bug reports show how VM escapes put servers at risk

guest Guest

guest Guest

guest Guest

guest Guest

mirimir Registered Member

guest Guest

guest Guest

guest Guest

Useful Searches