Virtualization Under Attack: Breaking out of KVM

Presented at Black Hat USA 2011, Aug. 4, 2011, 10 a.m. (60 minutes).

KVM, the Linux Kernel Virtual Machine, seems destined to become the dominant open-source virtualization solution on Linux. Virtually every major Linux distribution has adopted it as their standard virtualization technology for the future. And yet, to date, remarkably little work has been done on exploiting vulnerabilities to break out of KVM. We're here to fix that. We'll take a high-level look at KVM's architecture, comparing and contrasting with other virtualization systems and describing attack surfaces and possible weaknesses. Using the development of a fully-functioning exploit for a recent KVM vulnerability, we'll describe some of the difficulties involved with breaking out of a VM, as well as some features of KVM that are helpful to an exploit author. Once we've explored the exploit in detail, we'll finish off with a demonstration against a live KVM instance.

Presenters:

• Nelson Elhage

Links:

• https://www.blackhat.com/html/bh-us-11/bh-us-11-archives.html#Elhage
• https://media.blackhat.com/bh-us-11/Elhage/BH_US_11_Elhage_Virtunoid_Slides.pdf
• https://media.blackhat.com/bh-us-11/Elhage/BH_US_11_Elhage_Virtunoid_WP.pdf

Similar Presentations:

• DEF CON 19 (2011) / Virtualization Under Attack Breaking out of KVM
• Black Hat USA 2018 / Back to the Future: A Radical Insecure Design of KVM on ARM
• Black Hat USA 2021 / Alcatraz: A Practical Hypervisor Sandbox to Prevent Escapes from the KVM/QEMU and KVM-Based MicroVMs