Escape From The Docker-KVM-QEMU Machine

More documents

Recommendations

Info

QEMU_SET_IRQ 0x00007ffff794fe4c : mov rax,QWORD PTR [rbp-0x28] 0x00007ffff794fe50 : mov ecx,DWORD PTR [rax+0x40] 0x00007ffff794fe53 : mov rax,QWORD PTR [rbp-0x28] 0x00007ffff794fe57 : mov rax,QWORD PTR [rax+0x38] 0x00007ffff794fe5b : mov edx,DWORD PTR [rbp-0x2c] 0x00007ffff794fe5e : mov esi,ecx
OTHER STRUCTRES async.c struct QEMUBH { AioContext *ctx; QEMUBHFunc *cb; void *opaque; QEMUBH *next; bool scheduled; bool idle; bool deleted; }; Caller bh->cb(bh->opaque);
Page 1 and 2: Escape From The Docker-KVM-QEMU Mac
Page 3 and 4: I. Docker VM Escape
Page 5 and 6: KEY TECHNIQUES Container1 ROOTFS1 P
Page 7 and 8: VULUNERABILITY Container • Untrus
Page 9 and 10: ATTACK DOCKER swarm: 2375 attacker
Page 11 and 12: NAME SPACES asmlinkage long sys_clo
Page 13 and 14: TASK_STRUCT task_struct{ pid_t pid;
Page 15 and 16: FS_STRUCT struct fs_struct { int us
Page 17 and 18: ESCAPE POINT Container Process Cont
Page 19 and 20: GET FS_STRUCT fs_struct Container P
Page 21 and 22: SWITCT NSPROXY create_new_namespace
Page 23 and 24: docker escape demonstration
Page 25 and 26: II. KVM-QEMU VM ESCAPE
Page 27 and 28: KEY POINTS KVM-QEMU MEMORY LAYOUT S
Page 29 and 30: QEMU MEMORY ON HOST pocess memory l
Page 31 and 32: QEMU MEMORY MAPPING GUEST OS PYHSIC
Page 33 and 34: GUEST OS MEMORY char a20“Test by
Page 35 and 36: outb() EMULATED DEVICE
Page 37 and 38: EIP CONTROL
Page 39: EIP CONTROL ASM Dump of assembler c
Page 43 and 44: how to exploit
Page 45 and 46: BYPASS DEP&ASLR • CVE-2015-7504
Page 47 and 48: OTHER EXPLOIT WAYS • SYS_CALL
Page 49 and 50: ATTACK DEMO

Escape From The Docker-KVM-QEMU Machine

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?