back

The Great Escape of ESXi

Breaking Out of a Sandboxed Virtual Machine

If you suspend your transcription on amara.org, please add a timestamp below to indicate how far you progressed! This will help others to resume your work!

Please do not press “publish” on amara.org to save your progress, use “save draft” instead. Only press “publish” when you're done with quality control.

Video duration
00:40:17
Language
English
Abstract
VMware ESXi is an enterprise-class, bare-metal hypervisor developed by VMware for deploying and serving virtual computers. As the hypervisor of VMware vSphere, which is the world's most prevailing, state-of-the-art private-cloud software, ESXi plays a core role in the enterprise's cloud infrastructure. Bugs in ESXi could violate the security boundary between guest and host, resulting in virtual machine escape. While a few previous attempts to escape virtual machines have targeted on VMware workstation, there has been no public VMware ESXi escape until our successful demonstration at GeekPwn 2018. This is mainly due to the sandbox mechanism that ESXi has adopted, using its customized filesystem and kernel. In this talk, we will share our study on those security enhancements in ESXi, and describe how we discover and chain multiple bugs to break out of the sandboxed guest machine.

During the presentation, we will first share the fundamentals of ESXi hypervisor and some of its special features, including its own customized bootloader, kernel, filesystem, virtual devices and so on. Next, we will demonstrate the attack surfaces in its current implementations and how to uncover security vulnerabilities related to virtual machine escape. In particular, we will anatomize the bugs leveraged in our escape chain, CVE-2018-6981 and CVE-2018-6982, and give an exhaustive delineation about some reliable techniques to manipulate the heap for exploitation, triggering arbitrary code execution in the host context. Meanwhile, due to the existence of sandbox mechanism in ESXi, code execution is not enough to pop a shell. Therefore, we will underline the design of the sandbox and explain how it is adopted to restrict permissions. We will also give an in-depth analysis of the approaches leveraged to circumvent the sandbox in our escape chain. Finally, we will provide a demonstration of a full chain escape on ESXi 6.7.

Talk ID
10505
Event:
36c3
Day
1
Room
Borg
Start
8:50 p.m.
Duration
01:00:00
Track
Security
Type of
lecture
Speaker
f1yyy
Hanqing Zhao
Talk Slug & media link
36c3-10505-the_great_escape_of_esxi

Talk & Speaker speed statistics

Very rough underestimation:
106.3 wpm
598.4 spm
100.0% Checking done100.0%
0.0% Syncing done0.0%
0.0% Transcribing done0.0%
0.0% Nothing done yet0.0%
  

Work on this video on Amara!

Talk & Speaker speed statistics with word clouds

Whole talk:
106.3 wpm
598.4 spm
vmxstructureesxiguestaddressvmwarearbitrarydatasandboxvirtualosexploitstackcommandprocessescapefunctionexecutechecksystemfinallycodemachinewritef1yyyvulnerabilityshellfreerpcisizefakeusermemoryhostcallexecutionsoftwarevulnerabilitiesvmkernelpadchannelvmxnet3overwriteauthdsecondfindattackfileinetdfiller