Can a hypervisor hosting a firewall be exploited (providing access to other VM's) remotely?
Hey guys,
This is going to be a r/nostupidquestions type question, so bare with me.
In theory, is it possible for a hypervisor (ESXi) hosting a firewall (pfSense) to be exploited remotely? The thought process here is that technically, the hypervisor itself is internet facing, and it's running a proprietary OS (at least on ESXi it is). Couldn't a vulnerability be found within ESXi that is capable of breaking out of the virtual instance before hitting the firewall (VM Escape + traversing through to other hosts), or even evade the firewall entirely?
I'm having trouble wrapping my head around the networking portion, but otherwise I don't see why this couldn't happen.
Posted Mar 2, 2016, 1:14 AM UTC
36
If someone can get into your firewall, they can likely pivot to all sorts of places. VM escape methods are less likely a problem since the firewall hardening should be immensely better.
What I worry about is some unforeseen network protocol or hole or configuration at the hypervisor level that allows an attacker to overrun a buffer. Then they get access to your shit without having to get through the fortifications.
I use firewall devices as firewalls, but I'm oldschool apparently. All the kids are virtualizing their pfsenses.
I'd think you'd need to be able to remotely execute code on the firewall, before you could hop across the hypervisor to another VM.
That SHOULD mean pfsense is better than most at preventing that, due to limited amount of code running, hardened security principles, freeBSD, etc, but who knows what the next vulnerability will be in software that pfsense does utilise.
I'm like you, I have a lightweight atom proc'd device with 2 NIC's as a dedicated firewall. Mainly for me, because it allows my hypervisor to be shutdown/have a crash without affecting the internet.
Not necessarily.
It's possible there could be a weakness in the hypervisor itself. If it could be exploited by (for example) sending malformed or oversized packets then in principle you could compromise the host without needing to touch the pfsense guest.
Whether such a vulnerability is likely is obviously a different topic, but essentially it comes down to the sanity/security of every code path that might be followed in getting packets from the NIC to the virtualised NIC.
Once on, you could then look at pivoting to any device the host is able to get to, whether that's other VM's or physical devices reachable via the second NIC.
You can partially mitigate this risk my giving pfSense direct access to it's wan nic via PCI passthrough.
Very true, and it's definitely a saner thing to do than to simply bridge to the NIC for that reason.
Sadly, I've seen more than a few vm firewalls where that hasn't been though of.
An additional benefit of doing so, incidentally, is a (admittedly, slight) reduction in latency. I've seen setups where a full 5ms has been added to the RTT as a result of virtualising, switching to using PCI passthrough brought it down considerably (closer to 1 IIRC).
People often forget there's a reason some of the processing is outsourced to the NIC in enterprise routers.