Can a kernel exploit compromise an OpenVZ host?

Question

as openvz runs a a lot of virtual servers.

i wonder how kernel-exploits could affect the whole system.

would it be possible to break out of a "virtual machine" with a kernel-exploit on openvz??? (virtuozzo, ..)

Answer 1

OpenVZ hasn't had much vulnerability activity. However, OpenVZ creates "independent containers" for virtual machines to run in. By Compromising the kernel of a guest VM you do not automatically compromise the host OS. This is because hosts and guests do not share kernel space. In oder to do that you need to have a vulnerability in the surface area exposed by the host. A good example is VMWare has a DHCP server that the host runs and is a service provided to guest VM's. This DHCP service suffered from a buffer overflow. This type of attack vector is ideal candidate for an attacker to use to compromise the host.

That being said, one of the duty's of the kernel is to prevent unnecessary ware or damage to the underling hardware. So if you have kernel access on a virtual machine could you damage virtual hardware? Could you corrupt memory and obtain code execution? Maybe, but I don't know of a case where this has happened.

Answer 2

OpenVZ containers do not have their own kernels. In OpenVZ, there is only one kernel for the host OS and all of the containers. Successfully exploiting that kernel from within a container means potential impact to the OpenVZ host and all of its containers. If you want to avoid this vulnerability, you need a real hypervisor that boots in independent kernel for each virtual machine.

In his answer, Rook said that a kernel exploit would only affect the container's kernel, but not the host OS kernel. That is nonsense. There is only one kernel with OpenVZ.