Gregory's Server
this is bad, really bad. it is bad because an attacker can exploit qemu, and then break into a user account which has direct access to other customers' data.
|
2 comments
@ariadne@treehouse.systems yes, this is terrible. The best approach (even if it can be effective only if the exploit is in the user part, not the kernel part) is the one I generally use in FreeBSD: putting every different client's VM inside a jail.
|
"well that can't happen," you might say.
it has before: https://conference.hitb.org/hitbsecconf2021ams/materials/D2T2%20-%20A%20Black%20Box%20Escape%20Of%20Qemu%20Based%20On%20The%20USB%20Device%20-%20L.%20Kong,%20Y.%20Zhang%20&%20H.%20Qu.pdf