<div dir="ltr">hm, i think i am starting to see the problem... But i am not sure an additional 10,000+ lines of code running in ring0 is the solution to preventing local priv esc...especially when they are parsing anything from paths over memory ranges to PE file headers. There has to be some better way. </div><div class="gmail_extra"><br><div class="gmail_quote">2014-11-13 13:34 GMT+01:00 Michal Necasek <span dir="ltr"><<a href="mailto:michal.necasek@oracle.com" target="_blank">michal.necasek@oracle.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
Hardening is supposed to protect against a malicious user on the host<br>
(in other words, privilege escalation). A compromised host is a<br>
compromised host and there's nothing we can really do about it, but that<br>
is what hardening is in fact supposed to prevent.<br>
<br>
Hardening is unrelated to guest-to-host (I think that's what you<br>
meant) escape vulnerabilities.<br>
<br>
Please understand that we are not allowed to talk about details of<br>
specific vulnerabilities. The CVEs are public and if you want to know<br>
more, you need to either ask your Oracle support representative or the<br>
security researchers who reported the vulnerabilities. You won't get<br>
that sort of information from VirtualBox developers.<br>
<br>
And as for the "Windows security architecture", the less said the<br>
better. Let's just say that Microsoft started seriously thinking about<br>
(Windows NT) security about 10 years too late. Securing VirtualBox on a<br>
Windows host is massively more complex than doing the same on a<br>
Unix/Linux host due to the underlying OS design, as should be obvious<br>
from the VirtualBox source code.<br>
<br>
<br>
Michal<br>
<span class=""><br>
On 11/13/2014 5:14 AM, Felix morack wrote:<br>
> thanks for the replies.<br>
><br>
> - yes, i am referring to windows specifically.<br>
> - i am talking about version 4.3.12 as the latest working version<br>
> - specifically i am referring to issues as detailed here:<br>
> <a href="https://forums.virtualbox.org/viewtopic.php?f=6&t=64111" target="_blank">https://forums.virtualbox.org/viewtopic.php?f=6&t=64111</a><br>
> you can find similar threads for all the versions since 4.3.12<br>
><br>
><br>
> i cant help but to think there is some misunderstanding with the windows<br>
> security architecture. It seems much of the hardening has been around<br>
> much longer than version 4.3.12, right? Can someone say what the general<br>
> purpose of the hardening thing is? is it supposed to make more difficult<br>
> the exploitation of host-to-guest escape vulnerabilities? It seems to me<br>
> some of the code is protecting against a compromised *host*? What for?<br>
><br>
> 2014-11-12 11:18 GMT+01:00 Ramshankar<br>
> <<a href="mailto:ramshankar.venkataraman@oracle.com">ramshankar.venkataraman@oracle.com</a><br>
</span>> <mailto:<a href="mailto:ramshankar.venkataraman@oracle.com">ramshankar.venkataraman@oracle.com</a>>>:<br>
<div><div class="h5">><br>
> On 11/12/2014 02:18 AM, Sérgio Basto wrote:<br>
><br>
> On Ter, 2014-11-11 at 12:50 +0100, Felix morack wrote:<br>
><br>
> Like so many people i am still running 4.12 due to the<br>
> "hardening"<br>
> issues.<br>
><br>
> what people ?<br>
><br>
> yes, i reported a bunch of them back when we first started,<br>
> and yes i<br>
> have since tested all versions up to 4.18.<br>
><br>
> where ?<br>
><br>
> We are now nearing a point where i cant deploy 4.12 anymore<br>
> due to<br>
> formal security regulations, so i have to get serious about<br>
> this now.<br>
><br>
> I am therefore looking for a detailed, technical description<br>
> of this<br>
> new 'feature' and why devs think it is necessary.<br>
><br>
> Yes, i have the code, but a high level reasoning would be very<br>
> helpful, especially what has changed with version 4.12.<br>
> Specifically i<br>
> am looking for documentation "between" the source code and<br>
> the manual.<br>
> Does such a documentation exist in public? Any technical<br>
> discussion of<br>
> it perhaps?<br>
><br>
> Background is that i am think about deploying my own custom<br>
> build with<br>
> hardening disabled.<br>
><br>
> I remember I have to enable h ardening feature on kernel modes<br>
> (.ko) at<br>
> some point and hardening feature should be enabled , for security<br>
> reasons .<br>
> But I'd like to know what "hardening feature issues" do we have .<br>
><br>
><br>
> Although it's not explicitly mentioned so far, I'm pretty sure the<br>
> hardening issue being discussed in this thread is regarding<br>
> hardening on Windows hosts only.<br>
><br>
> Also, @ original poster: there is no VirtualBox "4.12" version, are<br>
> you referring to 4.1.2 or 4.3.12 or something else? (Just for the<br>
> sake of correctness)<br>
><br>
> Regards,<br>
> Ram.<br>
><br>
><br>
><br>
> Thanks,<br>
><br>
> Which is pretty insane, but there is no chance in hell<br>
> anything post<br>
> 4.12 ends up even in proximity to systems whose stability i am<br>
> responsible for.<br>
><br>
><br>
> tb<br>
><br>
><br>
> p.s. does vmware have such a feature? How do they handle it?<br>
><br>
><br>
</div></div>> _________________________________________________<br>
> vbox-dev mailing list<br>
> <a href="mailto:vbox-dev@virtualbox.org">vbox-dev@virtualbox.org</a> <mailto:<a href="mailto:vbox-dev@virtualbox.org">vbox-dev@virtualbox.org</a>><br>
> <a href="https://www.virtualbox.org/__mailman/listinfo/vbox-dev" target="_blank">https://www.virtualbox.org/__mailman/listinfo/vbox-dev</a><br>
> <<a href="https://www.virtualbox.org/mailman/listinfo/vbox-dev" target="_blank">https://www.virtualbox.org/mailman/listinfo/vbox-dev</a>><br>
<div class="HOEnZb"><div class="h5">><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> vbox-dev mailing list<br>
> <a href="mailto:vbox-dev@virtualbox.org">vbox-dev@virtualbox.org</a><br>
> <a href="https://www.virtualbox.org/mailman/listinfo/vbox-dev" target="_blank">https://www.virtualbox.org/mailman/listinfo/vbox-dev</a><br>
><br>
<br>
<br>
_______________________________________________<br>
vbox-dev mailing list<br>
<a href="mailto:vbox-dev@virtualbox.org">vbox-dev@virtualbox.org</a><br>
<a href="https://www.virtualbox.org/mailman/listinfo/vbox-dev" target="_blank">https://www.virtualbox.org/mailman/listinfo/vbox-dev</a><br>
</div></div></blockquote></div><br></div>