Detail CAPEC-480

CAPEC-480

Escaping Virtualization
2019-09-30
00h00 +00:00
Rendah
Draft
2021-10-21
00h00 +00:00
CAPEC Mitre.org
Peringatan untuk CAPEC tertentu
Tetap terinformasi tentang perubahan untuk CAPEC tertentu.
Kelola notifikasi

Deskripsi CAPEC

An adversary gains access to an application, service, or device with the privileges of an authorized or privileged user by escaping the confines of a virtualized environment. The adversary is then able to access resources or execute unauthorized code within the host environment, generally with the privileges of the user running the virtualized process. Successfully executing an attack of this type is often the first step in executing more complex attacks.

Informasi CAPEC

Alur Eksekusi

1) Explore

[Probing] The adversary probes the target application, service, or device to find a possible weakness that would allow escaping the virtualized environment.

Teknik
  • Probing applications, services, or devices for virtualization weaknesses.
2) Experiment

[Verify the exploitable security weaknesses] Using the found weakness, the adversary attempts to escape the virtualized environment.

Teknik
  • Using an application weakness to escape a virtualized environment
3) Exploit

[Execute more complex attacks] Once outside of the virtualized environment, the adversary attempts to perform other more complex attacks such as accessing system resources or executing unauthorized code within the host environment.

Teknik
  • Executing complex attacks when given higher permissions by escaping a virtualized environment

Mitigasi

Ensure virtualization software is current and up-to-date.
Abide by the least privilege principle to avoid assigning users more privileges than necessary.

Kelemahan Terkait

CWE-ID Nama Kelemahan

CWE-693

 Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis
CAPEC Content Team The MITRE Corporation 2019-09-30 +00:00

Modifikasi

Nama Organisasi Tanggal Komentar
CAPEC Content Team The MITRE Corporation 2020-12-17 +00:00 Updated Resources_Required
CAPEC Content Team The MITRE Corporation 2021-06-24 +00:00 Updated Taxonomy_Mappings
CAPEC Content Team The MITRE Corporation 2021-10-21 +00:00 Updated Execution_Flow
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.