Subject: Re: [vserver] Vserver Kernel Exploits
From: Ted Barnes <madogdevelopment@gmail.com>
Date: Tue, 21 Jan 2014 15:18:27 -0500

Thanks so much Adrian - let me read, digest...appreciate the help!

On 01/19/14 11:42, Adrian Reyer wrote:
> Hi Ted,
>
> On Sun, Jan 19, 2014 at 09:55:22AM -0500, Ted Barnes wrote:
>    
>> 1)  I'm running gnome including Firefox in my vserver guests .  Is
>> it a correct assumption that such a guest is susceptible to the
>> types of kernel exploits that would allow an attacker to take
>> control of the guest as root (e.g., maybe some sort of sql
>> injenction off of an infected website)?  I.e., does the guest
>> architecture per se eliminate this sort of risk?  Or is the best one
>> can do is to use a current kernel, keep the guest patched etc.?
>>      
> A VServer root is still root, just with limited capabilities. E.g.:
> - No creating devices
> - No loading modules
> - No mounting of block devices
> - No changing of network setup
> In other words, it is much harder to hide as an attacker and to attack
> the rest of the system.
> You should keep current kernels to prevent the attacker from gaining
> additional privileges and become a danger to the host. It compares a bit
> to a virus scanner: if it is outdated, it is useless. Though on a quite
> higher level to be exploited.
>
>    
>> 2)  Should such an attack succeed, could the attacker then begin to
>> attack other guests on the network?
>>      
> Yes, they can do so as normal user as well. However, default settings
> don't allow e.g. using tcpdump.
>
>    
>> 3)  My guests are on a different subnet than the host.  Should such
>> an attack succeed in a guest, could it mount a successful attack on
>> the host over the network if the host had iptables in place, was up
>> to date in its patches etc.?
>>      
> Depends on the attack and your setup. By default, locally generated
> packets targetting local IP-Adresses will never leave the host. This is
> different with e.g. network namespaces.
>
> Regards,
> 	Adrian
>