Forenote: I'm not familiar with how virtualisation works on a low-level (but I'd certainly like to learn) so this question could arise from ignorance.

Example Scenario: One virtualised router is connected to a networked device. Appropriate firewall rules are in place (on the virtualised router) to ensure the device cannot communicate directly with the router and cannot contact any other networked device. However as the router is virtualised, network traffic must traverse the host OS and be passed onto the VM.

Question: Could a malicious device specifically craft a packet to cause undesired behaviour on the host when being sent through the network stack, thus gaining access to the host OS?

  • 1
    I have no example for it, but I would be surprised if the answer was no. – MechMK1 Nov 25 '20 at 14:33

All what is needed are bugs in the network stack of the target. And network stacks can be a complex beast and thus bugs are not unlikely. See for example CVE-2016-1287 where "crafted UDP packets" could "allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system."

  • Interesting. With this in mind, could it be said that it is best to block traffic as low-down the stack as possible (perhaps even in the driver)? Could the risk increase the further up the network stack an attacker's packet can travel? – Synthetic Ascension Dec 7 '20 at 16:29
  • @SyntheticAscension: Complexity means more bugs. The earlier a packet can be dropped the shorter the code path is which handles the packet and the smaller is the complexity - and thus the likelihood of bugs. – Steffen Ullrich Dec 7 '20 at 19:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.