Re: [Xen-users] Need help

[Simon Hobson <linux@xxxxxxxxxxxxxxxx>]

Omkar Kulkarni wrote:

> I am a student of engineering from India. I am working on my single 
> laptop only. As a part of my academic study I an working on xen 
> security issues. In this study, I need to simulate a simple or any 
> attack to dom0 or domU like hijacking , or denial of service attack 
> etc. I want to ask, how can i exploit domU or dom0 from domU. Is 
> there any procedure/steps/material to do that? I need an urgent help
Firstly, have a read of this (read the whole document, not just the 
bit this link takes you to) :
http://www.catb.org/~esr/faqs/smart-questions.html#urgent

Lack of planning on your part does not constitute an emergency on ours.
In other words, saying "I need urgent help" does not get you special 
treatment - you should have asked the questions earlier when it 
wasn't urgent.

In theory, since the hypervisor runs code from DomU, then it is 
possible that if a flaw (bug) exists in the hypervisor then it could 
be used by malicious code to cause either a crash (denial of service) 
or code execution. As already mentioned, there are no known exploits 
- if there were then they would have been fixed.
A second attack vector might be via the boot process. If Dom0 is 
using PyGrub to load and execute a kernel & initrd from the DomU 
filesystem in order to start a DomU, then there is a theoretical risk 
that a carefully crafted DomU filesystem could exploit a flaw in the 
filesystem access libraries used by PyGrub. Again, non are known 
about.
Then there are things like USB/PCI/VGA passthrough where control over 
system resources is passed over to a guest. This implies an elevated 
level of access to the hardware - and hence a risk of exploiting a 
flaw (which may in fact be a hardware flaw).
Lastly, I believe there are commands to send messages to the guest - 
eg a script in Dom0 can signal the guest to sync it's buffers out to 
disk. Again, there is the potential for flaws in that to allow a 
carefully crafted response to cause a crash or arbitrary code 
execution. But since the response is (I'm guessing) no more than a 
small integer, I doubt that there is much scope there.
--
Simon Hobson

Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed
author Gladys Hobson. Novels - poetry - short stories - ideal as
Christmas stocking fillers. Some available as e-books.

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxx
http://lists.xen.org/xen-users