No Hat 2025 - Y. Jia, X. Lei - DarkKiller: A QEMU/KVM Black Box Escape via Virtio Devices скачать в хорошем качестве

No Hat 2025 - Y. Jia, X. Lei - DarkKiller: A QEMU/KVM Black Box Escape via Virtio Devices

DarkKiller: A QEMU/KVM Black Box Escape via Virtio Devices The QEMU/KVM black box escape was first introduced at HITB2021AMS, offering a method for virtual machine escape in public cloud environments. However, achieving a stable black box escape is challenging without specific information about the host environment and the QEMU binary. The success of a black box escape heavily relies on the quality of the vulnerabilities, which are difficult to discover. In this talk, we will provide a brief overview of the QEMU/KVM architecture and the virtio architecture. We will outline the conditions necessary for a black box escape and discuss how to assess whether a vulnerability can be exploited for this purpose. We will detail two vulnerabilities we discovered in virtio devices and demonstrate how these can be exploited. Finally, we will illustrate the process of constructing a complete black box escape. At the GeekCon 2024 DAF contest in Singapore, our team successfully demonstrated a QEMU/KVM black box escape using the 0-day vulnerabilities discussed in this talk. To our knowledge, this represents the first public demonstration of a virtual machine black box escape at GeekCon or any other computer hacking contest. Yongkang Jia - Security Researcher Yongkang Jia is a security reseacher. His research focuses on Hardware Security and System Security, especially Virtualization Security. He has reported several vulnerabilities in KVM, QEMU, which were confirmed and credited in multiple advisories. He spoke at HITB2023HKT, HexaCon. Xiao Lei - Security Researcher Xiao Lei is a security researcher. He is a member of the AAA CTF Team. He also plays DEFCON CTF as a member of Katzebin. His research focuses on System Security, especially Virtualization Security. He has reported several vulnerabilities in QEMU and Virtualbox. He spoke at HITB2023HKT, HexaCon and attened DAF contest in Geekcon 2024 Singapore station. LINKS No Hat - Website: nohat.it No Hat - X: @nohatcon Y. Jia - X: @J_kangel