KVM flaw on AMD servers gave malicious VMs a route to take over the host

guest · Jun 30, 2021

KVM flaw on AMD servers gave malicious VMs a route to take over the host
Vuln thankfully patched following Google Project Zero disclosure
June 30, 2021
https://www.theregister.com/2021/06/30/kvm_flaw_on_amd_servers/

Google's Project Zero has emitted another vulnerability report, showing off a proof-of-concept exploit against the open-source KVM hypervisor that allows an attacker to escape a virtual machine on AMD-based servers – taking control of the underlying host system.

"To the best of my knowledge," Project Zero researcher Felix Wilhelm claimed of his discovery, "this is the first public write-up of a KVM guest-to-host breakout that does not rely on bugs in user space components such as QEMU."
The vulnerability, which was demonstrated through a proof-of-concept attack to launch a shell on a host system running on an AMD Epyc 7351P processor, relies on functionality exclusive to AMD chips – meaning Intel, the company's long-standing rival and current majority holder of the server market, is unaffected.
Click to expand...

"AMD's virtualization extension is called SVM (for Secure Virtual Machine) and in order to support nested virtualisation, the host hypervisor needs to intercept all SVM instructions that are executed by its guests, emulate their behaviour and keep its state in sync with the underlying hardware.

Wilhelm was able to find a bug quickly enough, spotting a method for malicious guests to gain access to the model-specific registers (MSRs) on the host.
Click to expand...

The finished attack, exploitable only in the KVM module included in the Linux 5.10 and 5.11 kernels and on AMD hardware, allows a malicious guest to gain full control over the host machine: the bug is triggered, a specific host MSR accessed, and a remote shell launched – a process which takes a maximum of five minutes.

More information is available on the Project Zero blog, in the proof-of-concept code on the Project Zero issue tracker, and in the patch notes on the Linux git repository. The Register has asked AMD for comment.
Click to expand...

Log in or Sign up

KVM flaw on AMD servers gave malicious VMs a route to take over the host

guest Guest

Log in or Sign up

KVM flaw on AMD servers gave malicious VMs a route to take over the host

guest Guest

Useful Searches