Security

Advisories

Brig, hull and hvi publish security advisories on GitHub. This page lists every published advisory, and the classes of VMM bug that the code is tested against.

Published advisories #

GHSA-wp6x-29qx-fpr7. An agent could replace a directory inside its project with a symlink to another host directory. A later run that named a path through the link exported that directory read-write into the sandbox. Brig 0.3.0 opens the project path one component at a time, refuses every symlink in the part the user can write, and holds the directory open while the runtime mounts it. The hypervisor and the guest kernel boundary held throughout. Reported by @p80n-sec.

hull and hvi have no published advisories. Each repository lists its own on GitHub: brig, hull and hvi-vmm. To report a vulnerability, see Report a vulnerability.

Bug classes #

Some classes of bug recur across VMMs and sandboxes. For each class below, Here says what the code does about it, and Tests names the tests that check it. Elsewhere gives a public example from another project. Each entry describes the code at the commits below. It does not claim that no bug of the class exists.

Each test links to its line in hvi-vmm at c6df2a9 or in brig at dc36d62.

These classes cover the macOS path. On Linux, urunc boots the sandbox on Cloud Hypervisor, which this page does not cover. For Brig's own promises, the claims table names the tests behind each one.

Emulated legacy devices #

Elsewhere. CVE-2015-3456: a guest writes past a buffer in QEMU's emulated floppy controller.

Here. hvi exposes four paravirtual devices on virtio-mmio, and a PL011 console. There is no PCI bus, no firmware and no emulated disk controller.

Tests. None checks the whole device list. fdt.rs builds it.

Descriptor indices and loops #

Elsewhere. CVE-2016-6490: a zero-length descriptor sends QEMU's virtqueue mapping into an infinite loop.

Here. Every descriptor index is checked against the ring. Every chain walk stops after as many descriptors as the ring holds.

Tests. descriptor_index_outside_the_ring_is_refused, a_descriptor_cycle_runs_out_of_budget, avail_idx_beyond_the_ring_is_refused.

Guest memory bounds #

Elsewhere. CVE-2019-18960: a Firecracker vsock buffer check lets a guest reach heap memory past the end of guest memory.

Here. Every access to guest memory goes through GuestRam. It refuses an address the guest does not own, and a range that leaves its region.

Tests. contains_bounds_the_length_as_well_as_the_address, a_read_may_not_straddle_the_seam, refused_write_touches_nothing.

Shared-directory escapes #

Elsewhere. CVE-2016-7116: a .. in a path reaches host files outside a QEMU 9p export.

Here. hvi resolves virtio-fs names by descriptor. A .. stops at the export root, and an absolute or climbing symlink target is re-rooted at the export. Since GHSA-wp6x-29qx-fpr7, Brig refuses a symlink in the part of a project path the user can write.

Tests. writable_names_cannot_escape_the_export, a_climbing_symlink_target_is_clamped_at_the_export_root, no_handler_reaches_outside_through_a_swapped_directory, TestAPlantedLinkNeverReachesTheRuntimeAsAShare.

Terminal escape injection #

Elsewhere. CVE-2024-38396: output sets iTerm2's window title and asks for it back, and the reply runs as input.

Here. hvi passes guest text and an allowlist of display sequences to your terminal. It drops the rest, including clipboard writes and queries that make the terminal answer.

Tests. host_state_and_query_sequences_are_dropped, a_sequence_split_across_writes_is_judged_whole.

Code running in the VMM #

Elsewhere. Any device bug that reaches code execution in the VMM process.

Here. hvi enters a deny-default Seatbelt profile before the first vCPU starts.

Tests. profile_is_deny_default, and hvi sandbox-selftest, which hvi-vmm's macOS CI job runs on every pull request. It fails unless every probe matches the profile.

Further reading #

Two posts on the NOFire blog go into more depth:

• The Sandboxing Manifesto sets out seven properties a sandbox should let you check.
• Why we wrote our own microVMM explains how hvi confines itself, and which rust-vmm crates it reuses.