Skip to main content

VMware Security Notice: CPU flaw may lead to guest VM privilege escalation!

Good to see VMware addressing the issue immediately. This is the one I also mentioned [briefly explained] when explaining the Rings and methods of deprivileging that are used to host guest VMs on a platform, in my last BrightTalk Summit talk.

VMware products emulate hardware functions and create the
possibility to run guest operating systems.

A flaw in the CPU hardware emulation might allow the virtual CPU to
incorrectly handle the Trap flag. Exploitation of this flaw might
lead to a privilege escalation on guest operating systems. An
attacker needs a user account on the guest operating system and
have the ability to run applications.

VMware would like to thank Derek Soeder for discovering
this issue and working with us on its remediation.

Source
Labels:

Comments

Post a Comment

Popular posts from this blog

Security: VMware Workstation 6 vulnerability

vulnerable software: VMware Workstation 6.0 for Windows, possible some other VMware products as well type of vulnerability: DoS, potential privilege escalation I found a vulnerability in VMware Workstation 6.0 which allows an unprivileged user in the host OS to crash the system and potentially run arbitrary code with kernel privileges. The issue is in the vmstor-60 driver, which is supposed to mount VMware images within the host OS. When sending the IOCTL code FsSetVoleInformation with subcode FsSetFileInformation with a large buffer and underreporting its size to at max 1024 bytes, it will underrun and potentially execute arbitrary code. Security focus
Post a Comment
Read more

Linux, Linux : Get started with VMWare and Knoppix or Ubuntu Live CD!

Well everyone's talking about it now and you're wondering "what the heck is Linux?". So you've finally come face to face with yourself and say it loudly(errum..In your head first , please). I want to learn it! I admit it, I've been a fool! I hafta learn this kool OS! OK chill! You're faced with a challenge of all that installation crap. And boy, ask the veterans they've made lot's of money just installing Linux and installing Oracle on Linux was a big thing. And talking about setting about clusters was only for Big Boys and doing Oracle RAC setup was only for BEEEG BOYZ!!! Ok I can see you're already sleeping on my story. And Hey! Stop drooling on my shoulder! Wake up!!! You yell back at me " WHAT DO I HAFTA DO? WHERE I GOTTA KLIK? I Don't wanna fight with my wife over installing Linux at home? And my Microsoft Boss is angry because I made my colleagues so scared when I installed Linux at work? Ok Ok I get it. You want to learn it'...
7 comments
Read more