{"id":18697,"date":"2015-07-15T08:34:49","date_gmt":"2015-07-15T07:34:49","guid":{"rendered":"https:\/\/aidanfinn.com\/?p=18697"},"modified":"2015-08-14T10:43:42","modified_gmt":"2015-08-14T09:43:42","slug":"ms15-068serious-hyper-v-security-vulnerability","status":"publish","type":"post","link":"https:\/\/aidanfinn.com\/?p=18697","title":{"rendered":"MS15-068–SERIOUS Hyper- V Security Vulnerability"},"content":{"rendered":"

This is one of those rare occasions where I\u2019m going to say: put aside everything you are doing, test this MS15-068<\/a> patch now, and deploy it as soon as possible.<\/p>\n

The vulnerabilities could allow remote code execution in a host context if a specially crafted application is run by an authenticated and privileged user on a guest virtual machine hosted by Hyper-V. An attacker must have valid logon credentials for a guest virtual machine to exploit this vulnerability.<\/p>\n

This security update is rated Critical for Windows Hyper-V on Windows Server 2008, Windows Server 2008 R2, Windows 8 and Windows Server 2012, and Windows 8.1 and Windows Server 2012 R2. For more information, see the Affected Software<\/strong> section.<\/p>\n

The security update addresses the vulnerabilities by correcting how Hyper-V initializes system data structures in guest virtual machines.<\/p><\/blockquote>\n

I don\u2019t know if this is definitely what we would call a \u201cbreakout attack\u201d (I\u2019m awaiting confirmation), one where a hacker in a compromised VM can reach out to the host, but it sure reads like it. This makes it the first one of these that I\u2019ve heard of in the life of Hyper-V (since beta of W2008) \u2013 VMware fanboys, you\u2019ve had a few of these so be quiet.<\/p>\n

Note:<\/p>\n

Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was originally issued Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.<\/p><\/blockquote>\n

It sounds like a reasonable organization found and privately disclosed this bug, thus allowing Microsoft to protect their customers before it became public knowledge. Google could learn something here.<\/p>\n

So once again:<\/p>\n

    \n
  1. Test the patch <\/em><\/u><\/strong>quickly<\/li>\n
  2. Push it out to secure hosts and other VMs<\/li>\n<\/ol>\n

    [Update]<\/p>\n

    Some digging by Flemming Riis<\/a> (MVP) discover that credit goes to Thomas Garnier, Senior Security Software Development Engineer at Microsoft (a specialty in kernel, hypervisor, hardware, cloud and network security), and currently working on Azure OS (hence the Hyper-V interest, I guess). He is co-author of Sysinternals Sysmon<\/a> with Mark Russinovich.<\/p>\n

    \"image\"<\/a><\/p>\n

    Technorati Tags: Hyper-V<\/a>,Virtualisation<\/a>,Security<\/a>,Windows Server 2008<\/a>,Windows Server 2008 R2<\/a>,Windows Server 2012<\/a>,Windows Server 2012 R2<\/a>,Windows 8.1<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"

    This is one of those rare occasions where I\u2019m going to say: put aside everything you are doing, test this MS15-068 patch now, and deploy it as soon as possible. The vulnerabilities could allow remote code execution in a host context if a specially crafted application is run by an authenticated and privileged user on … Continue reading “MS15-068–SERIOUS Hyper- V Security Vulnerability”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":18385,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_wpcom_ai_launchpad_first_post":false,"footnotes":""},"categories":[20],"tags":[181,190,195,110,116,117,118,120],"class_list":["post-18697","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hyper-v","tag-hyper-v","tag-security","tag-virtualisation","tag-windows-8-1","tag-windows-server-2008","tag-windows-server-2008-r2","tag-windows-server-2012","tag-windows-server-2012-r2"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t