Скачать или смотреть Alcatraz: A Practical Hypervisor Sandbox to Prevent Escapes from the KVM/QEMU and KVM-Based MicroVMs

Since DevOps and serverless architecture emerged, cloud vendors have supported container services as well as traditional virtual machine (VM) services. A traditional VM is strongly isolated from a host machine because a Virtual Machine Monitor (VMM), aka hypervisor, splits it with virtualized hardware. In contrast, a container uses kernel-level isolation techniques such as namespace and cgroup. They make containers faster than VMs. However, containers share the host kernel, so attackers can escape from the container with a kernel vulnerability.

Recent containers leverage hypervisor technology to overcome this problem. These architectures provide strong isolation, but there is still room for improvement. Attackers can still escape from them...

By: Seunghun Han

Full Abstract & Presentation Materials:
https://www.blackhat.com/us-21/briefi...