3 ms·

What privileges does bhyve run under? Exploiting a properly sandboxed QEMU does give you access to some potentially interesting file descriptor but, unless you

What privileges does bhyve run under? Exploiting a properly sandboxed QEMU does give you access to some potentially interesting file descriptor but, unless you can use them to get kernel code execution, your process will not have access to any resources on the host that wouldn't be already accessible from inside the VM.

saagarjha 7y ago
There's a section on sandbox escapes.
yjftsjthsd-h 7y ago
Doesn't running it with KVM enabled put you back into kernel space? I'm sure doing everything in userspace is safer, but TCG is nowhere near as performant...
- monocasa 7y ago
  The vast majority of the device emulation is in user space, even with KVM.
- bonzini 7y ago
  KVM is indeed one of the potentially interesting file descriptors, but there is relatively little code running in kernel space.
monocasa 7y ago
Almost all attacks these days are a chain of exploits that each focus on jumping code execution to a new context or gaining a new privilege, that only when combined give you the access you're looking for as an attacker.