Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

as openvz runs a a lot of virtual servers.

i wonder how kernel-exploits could affect the whole system.

would it be possible to break out of a "virtual machine" with a kernel-exploit on openvz??? (virtuozzo, ..)

share|improve this question
add comment

2 Answers

OpenVZ containers do not have their own kernels. In OpenVZ, there is only one kernel for the host OS and all of the containers. Successfully exploiting that kernel from within a container means potential impact to the OpenVZ host and all of its containers. If you want to avoid this vulnerability, you need a real hypervisor that boots in independent kernel for each virtual machine.

In his answer, Rook said that a kernel exploit would only affect the container's kernel, but not the host OS kernel. That is nonsense. There is only one kernel with OpenVZ.

share|improve this answer
add comment

OpenVZ hasn't had much vulnerability activity. However, OpenVZ creates "independent containers" for virtual machines to run in. By Compromising the kernel of a guest VM you do not automatically compromise the host OS. This is because hosts and guests do not share kernel space. In oder to do that you need to have a vulnerability in the surface area exposed by the host. A good example is VMWare has a DHCP server that the host runs and is a service provided to guest VM's. This DHCP service suffered from a buffer overflow. This type of attack vector is ideal candidate for an attacker to use to compromise the host.

That being said, one of the duty's of the kernel is to prevent unnecessary ware or damage to the underling hardware. So if you have kernel access on a virtual machine could you damage virtual hardware? Could you corrupt memory and obtain code execution? Maybe, but I don't know of a case where this has happened.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.