Virtual pain in the rear
We all love virtual machines. Ok, not all of us, but they are the “way of the future.” Virtual servers cut down on hardware costs, cooling costs, maintenance costs, and a slew of other things. Not only that, but their cool! One machine that can run your web server, app server, storage server, directory, printing, and whatever else you can think of. Who wouldn't find that cool (probably someone not in an IT department...)? However, we have to remember that having everything on one machine gives us a single point of failure.
Thats a slight buzz kill isn't it? One machine goes down and your entire network stops working. Case in point, on Janurary 10th 2008 Security Focus published a XEN security vulnerability that basically performs a DOS (Denial Of Service) attack on all your virtual hosts.
The exploit targets the hypervisor. XEN's hypervisor is what facilitates communication between the virtual machine and your actual hardware. It handles interrupts, resource allocation and checks page tables. If your hypervisor goes down, your virtual hosts can't even boot. Basically, its a DOS attack for your virtual machines.
This exploit affects a few products. First and foremost is the XEN product itself. Also affected are most distributions of SUSE Linux (OpenSUSE, SLES and SLED kernel 2.6.5).
Fortunately there are no known working exploits that target this vulnerability, and vendors have already released updates (so go get them!).
Thats a slight buzz kill isn't it? One machine goes down and your entire network stops working. Case in point, on Janurary 10th 2008 Security Focus published a XEN security vulnerability that basically performs a DOS (Denial Of Service) attack on all your virtual hosts.
The exploit targets the hypervisor. XEN's hypervisor is what facilitates communication between the virtual machine and your actual hardware. It handles interrupts, resource allocation and checks page tables. If your hypervisor goes down, your virtual hosts can't even boot. Basically, its a DOS attack for your virtual machines.
This exploit affects a few products. First and foremost is the XEN product itself. Also affected are most distributions of SUSE Linux (OpenSUSE, SLES and SLED kernel 2.6.5).
Fortunately there are no known working exploits that target this vulnerability, and vendors have already released updates (so go get them!).