VMware posted this article where academic research has found a vulnerability with Transparent Page Sharing (TPS). Apparently they can use this to determine the “private” AES encryption key of another virtual machine. Woops … another “breakout attack” for VMware. I’m still waiting on the first one for Hyper-V.
TPS is one of those features that vFanboys cling to when attacking Hyper-V Dynamic Memory. Now VMware are turning if off by default (starting Q4 2014 for ESXi 5.1, and later for other versions). Hmm, this case raises questions about the security design of vSphere.
Choose your hypervisor carefully – breakout attacks are BAD.
I wonder what fresh hate will be vomited in my direction by the vFanboys 😀 Thanks to Flemming Riis (@FlemmingRiis) for the heads up.