Talk:Virtual machine escape

Computer Security: Computing Low‑importance

This article is within the scope of WikiProject Computer Security, a collaborative effort to improve the coverage of computer security on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.Computer SecurityWikipedia:WikiProject Computer SecurityTemplate:WikiProject Computer SecurityComputer Security

Low

This article has been rated as Low-importance on the project's importance scale.

This article is supported by WikiProject Computing (assessed as Low-importance).

Things you can help WikiProject Computer Security with:

Article alerts will be generated shortly by AAlertBot. Please allow some days for processing. More information...

Review importance and quality of existing articles
Identify categories related to Computer Security
Tag related articles
Identify articles for creation (see also: Article requests)
Identify articles for improvement
Create the Project Navigation Box including lists of adopted articles, requested articles, reviewed articles, etc.
Find editors who have shown interest in this subject and ask them to take a look here.

Computing: Software / Security Low‑importance

This article is within the scope of WikiProject Computing, a collaborative effort to improve the coverage of computers, computing, and information technology on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.ComputingWikipedia:WikiProject ComputingTemplate:WikiProject ComputingComputing

Low

This article has been rated as Low-importance on the project's importance scale.

This article is supported by WikiProject Software (assessed as Low-importance).

This article is supported by WikiProject Computer Security (assessed as Low-importance).

Things you can help WikiProject Computer Security with:

Article alerts will be generated shortly by AAlertBot. Please allow some days for processing. More information...

Review importance and quality of existing articles
Identify categories related to Computer Security
Tag related articles
Identify articles for creation (see also: Article requests)
Identify articles for improvement
Create the Project Navigation Box including lists of adopted articles, requested articles, reviewed articles, etc.
Find editors who have shown interest in this subject and ask them to take a look here.

Examples (Preferably documented)

ZSNES recently had a patch to block it from running x86 code. It's a 65816-based-SNES emulator so has no business running native code, obviously. https://www.youtube.com/watch?v=Q3SOYneC7mU
VMWare also recently made a patch but that was already mentioned.
Java has multiple patches for this. One of the oldest was the one where a method (collection of VM-executable bytecode) could have a negative value (signed) size, but that the actual data was 65533 bytes (unsigned). This was fixed around 2003 I think. A list of several exploits: https://cyberoperations.wordpress.com/offense/06-metasploit-basics-attacking-java/ This is a more recent one: http://timboudreau.com/blog/The_Java_Security_Exploit_in_(Mostly)_Plain_English/read
I left out code like that used for JPEG decoding since that is not generally considered any kind of virtualization. It's just a compressor. Compression, encryption, and sim/emulation all share quite a bit in common, though.
73.181.82.26 (talk) 06:23, 4 September 2015 (UTC)[reply]