Put into plain English, this means that the security checks used by the host to stop guests messing with each other’s memory didn’t always work. Full security checks were slowing things down, so a shortcut was programmed that turned out to be inadequate, introducing a loophole for attackers.
In this case, the bug wan’t just a guest-to-guest problem, but a guest-to-host bug. In other words, the guest could mess with the entire server, and thus implicitly with any other guest as well.
For more info:
https://nakedsecurity.sophos.com/2016/07/28/the-xen-bunker-buster-bug-what-you-need-to-know/
No comments:
Post a Comment