5

Recently a design flaw in some Intel X86 processors was revealed at Blackhat. The flaw enables malicious code to gain access to SMM. The flaw can be exploited by an attacker with administrator privileges.

Can the flaw be exploited from within a virtual machine in hypervisors like VirtualBox, Qemu ... etc. if VT-x is enabled?

  • 4
    Can you provide links to references of this flaw? – RoraΖ Aug 19 '15 at 12:17
  • @raz Sorry, I forgot that. I have updated the question with a link. – user83822 Aug 19 '15 at 15:51
3

CPU Virtualization Basics

CPU virtualization emphasizes performance and runs directly on the processor whenever possible. The underlying physical resources are used whenever possible and the virtualization layer runs instructions only as needed to make virtual machines operate as if they were running directly on a physical machine.

CPU virtualization is not the same thing as emulation. With emulation, all operations are run in software by an emulator. A software emulator allows programs to run on a computer system other than the one for which they were originally written. The emulator does this by emulating, or reproducing, the original computer’s behavior by accepting the same data or inputs and achieving the same results. Emulation provides portability and runs software designed for one platform across several platforms.

When CPU resources are overcommitted, the ESX/ESXi host time-slices the physical processors across all virtual machines so each virtual machine runs as if it has its specified number of virtual processors. When an ESX/ESXi host runs multiple virtual machines, it allocates to each virtual machine a share of the physical resources. With the default resource allocation settings, all virtual machines associated with the same host receive an equal share of CPU per virtual CPU. This means that a single-processor virtual machines is assigned only half of the resources of a dual-processor virtual machine.

VMWare Article Explaining how virtualization works

This tells me that if the host processor running the virtual machine is vulnerable then it is possible that the VM iteself can be an entry point to the exploit since the code running on the processor. My assumption is that it doesn't matter the entry point into SMM so long as it gets in and can execute. So if you have a virual machine with access to any hardware it seems that it is likely affected. I can not confirm definitively that is the case, but I would most definitely take caution if you have host hardware running virtual machines that is susceptible to this vulnerability. Intel is planning to release a patch if they haven't already.

1

No, with or without VT-x (paravirtualization or hardware assisted virtualization respectively), as Virtual Machines get assigned their own portion of memory. They don't get to play with APIC.

This assumes one cannot break out of the Virtual Machine, e.g. a flaw in inter-VM protocols, PCI passthrough without IOMMU (Vt-d).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.