TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Xen exploitation part 3: XSA-182, Qubes escape

81 点作者 sprin将近 9 年前

4 条评论

olympus将近 9 年前
If you&#x27;re a security newb like me but you are using Qubes, update your dom0 software and this vulnerability is fixed. run:<p>sudo qubes-dom0-update<p>The exploit itself allows an attacker who gains control of one domain (like your untrusted cat video domain) to execute scripts in any domain.
geofft将近 9 年前
Style points for running xcalc to demonstrate arbitrary code execution on a UNIX desktop. calc.exe is pretty common for this sort of thing on Windows, but I think I&#x27;d forgotten xcalc even existed until seeing the screenshot. :)
评论 #12236732 未加载
timthelion将近 9 年前
While Qubes is probably the most secure desktop OS available, reading through this code shows the extreme conflict between high performance code. Especially highly optimized C code, and security. When I look at that code, I cannot use intuition, I have to think really hard to understand what it is doing and even in doing so, I might well be wrong in my understanding.
pyvpx将近 9 年前
at what point do we all say &quot;maybe Xen isn&#x27;t the best hypervisor to work with for this sort of goal&quot;?