The just-patched critical vulnerability in widely used virtualization software is an ideal exploitation target for state-sponsored spies and criminals alike fishing for passwords, cryptography keys, or Bitcoin, a researcher who has dissected one of the fixes said.
The bug, which is known to affect the Xen, KVM, and native QEMU virtual machine platforms and appliances, makes it possible for attackers to break out of protected guest environments and take full control of the operating system hosting them, security researchers warned Wednesday. In the hours following Wednesday morning's disclosure of the vulnerability, many security professionals have publicly said its severity is being exaggerated. The critics have rightly pointed out that it can't be remotely exploited and can't be exploited on large numbers of machines in a single stroke, as is the case with most serious security bugs.
Rob Graham, CEO of security firm Errata Security, has indicated that the bug is still worth taking seriously. For one thing, he suspects it will be easy for attackers to exploit the flaw. For another, he said exploits could yield highly valuable assets on vulnerable machines, particularly on virtual private servers, which use virtualization to segregate different customers' data on the same physical machine. In a blog post published a few hours after the vulnerability came to light, Graham wrote:
Read 1 remaining paragraphs | Comments