Announcement

Collapse
No announcement yet.

VENOM Bug In QEMU Escapes VM Security

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • VENOM Bug In QEMU Escapes VM Security

    Phoronix: VENOM Bug In QEMU Escapes VM Security

    The latest high-profile security vulnerability affecting open-source software and impacting mass amounts of systems worldwide is dubbed VENOM...

    Phoronix, Linux Hardware Reviews, Linux hardware benchmarks, Linux server benchmarks, Linux benchmarking, Desktop Linux, Linux performance, Open Source graphics, Linux How To, Ubuntu benchmarks, Ubuntu hardware, Phoronix Test Suite

  • #2
    But you still need root on the guest OS (according to their FAQ), so it's not as bad as it looks like.

    Comment


    • #3
      Originally posted by Dragoon Aethis View Post
      But you still need root on the guest OS (according to their FAQ), so it's not as bad as it looks like.
      When renting out a VM on most clouds, you get root access...
      Michael Larabel
      https://www.michaellarabel.com/

      Comment


      • #4
        Apparently root access on KVM (etc) gives you more than on other VMs!! (just trying to put positive marketing spin on it)

        Comment


        • #5
          Originally posted by Michael View Post
          When renting out a VM on most clouds, you get root access...
          Yes, but you'd have to perform this attack yourself/be unlucky enough to share the same host machine with attacker (and messing with other people's VMs would get you banhammered out of any clouds faster than your local pizzeria delivers your Victory Mexicana), and it doesn't let you attack any machines from the outside. And it's patched, too.

          Comment


          • #6
            I've been waiting for this basically ever since listening to this talk:
             

            Comment


            • #7
              This is exactly why I run all my VMs inside a Docker container that's running inside another VM that's running on a server that sits inside a maximum security prison with no connection to the Internet!

              Comment


              • #8
                This kind of proves that there simply aren't enough people out there to find every security hold in existence ahead of time. No one was focusing on that area of code, and that just so happened to be where the vulnerability was.

                Comment


                • #9
                  How widely used is the virtual floppy disk option?

                  Comment


                  • #10
                    Originally posted by DanL View Post
                    How widely used is the virtual floppy disk option?
                    And more importantly, are VMs which don't have virtual floppy drives affected? Because that would severely limit the no. of affected systems...

                    Comment

                    Working...
                    X