Number: IRCNE2015102673
Date: 2015/10/25
According to “computerworlduk”, the Xen Project fixed several vulnerabilities in its popular virtualization software, including one that could allow potential attackers to break out of a virtual machine and gain control over the host system.
Vulnerabilities that break the isolation layer between virtual machines are the most serious type for a hypervisor like Xen, whose main goal is to allow running multiple VMs on the same hardware in a secure manner.
The Xen patches released Thursday fix a total of nine vulnerabilities, but the privilege escalation one identified as CVE-2015-7835 is the most serious one.
As such, the flaw can only be exploited by malicious administrators of PV guests and only on x86 systems, the Xen Project said in an advisory. Xen versions 3.4 and higher are vulnerable.
- 6