Home / Series / DEF CON / Aired Order / Season 32 / Episode 91

Dragon SlayingGuide: Bug Hunting In VMware Device Virtualization

In this presentation, we will unveil a new attack surface: Device Virtualization in VMKernel. This isan unknown territory that has not been explored by security researchers to date. During the reverse engineering of the VMware Hypervisor, we discovered 8 vulnerabilities related to device virtualization, 3 of them have been assigned CVE number (some vulnerabilities have even been successfully exploited in Tianfu Cup), and the remaining 5 of our vulnerabilities have been officially confirmed by VMware. Firstly we will delve into the loading process of vmm, the implementation of data sharing between vmm and vmx, and VMware's UserRPC, which facilitates communication between the Hypervisor and the Host. These mechanisms are crucial in virtual device emulation. Then We will explain security issues in various parts of the USB system, including the host controller, VUsb middleware, and VUsb backend devices, based on the vulnerabilities we have unearthed.

English
  • Originally Aired August 11, 2024
  • Runtime 45 minutes
  • Created August 25, 2024 by
    Subscriber-2473783
  • Modified August 25, 2024 by
    Subscriber-2473783