Breaking Theoretical Limits: The Gap Between Virtual NICs and Physical Network Cards
No ratings
Presented at BlackHat Europe 2023 by
Virtualization technology, which is a crucial component of the cloud, provides the foundational technology for creating and managing virtual resources like virtual servers and virtual networks. Within a cloud environment, virtual machines are usually supplied with virtual NICs (Network Interface Cards), which allow virtual machines to connect to the network and communicate with other computers or devices over the internet. Considering the virtual NIC serves as a fundamental and low-level infrastructure, it has already become an appealing target for security researchers.When playing with virtual NICs in Hyper-V, it turns out that the implementation remains consistent with that of physical network cards. Consequently, hidden preconditions inherent in the implementation remain unchanged. Specifically, it's well-known that there are length limitations on the IP packet from physical network cards. A single IP packet (unmerged fragmented packet) can't be shorter than 28 bytes or longer than 65535 bytes. However, due to the differences between the virtual NICs and physical network cards, these length limitations can be breached. That is, some hidden preconditions in the implementation of the protocol stack may not be true and if abused, it may lead to server vulnerabilities.In this presentation, we will first focus on the netvsp.ko module from Hyper-V guest environment, detail its architecture and the mechanism of IP packet transmission. Then we will demonstrate how to send legal IP packets that break length limitations to Hyper-V from the guest environment. Furtherly, we will dive into the network modules of Hyper-V, and provide a comprehensive comparison of the IP packet process routines between virtual NICs and real network cards. Then we will share some vulnerabilities existing in IP packet process routines by breaking the theoretical limits outlined by RFC. By utilizing these vulnerabilities as case studies, we aim to illustrate our efforts to overcome the restrictions imposed by physical network cards, and hope it serves as a new direction for code review or fuzzing when targeting virtual NICs.Please Note: Speaker is Presenting Remotely.