"Tale of two hypervisor bugs - Escaping from #FreeBSD #bhyve"

http://phrack.org/papers/escaping_from_freebsd_bhyve.html

^ Author had to reintroduce a vulnerability to successfully exploit on #HardenedBSD:

"All the previously detailed techniques will no
longer work."

The CFI bypass will be fully mitigated with my Cross-DSO CFI work, which is yet to land.

The SafeStack bypass would be mitigated with SROP.

"A bug in any of the whitelisted IOCTL command could allow code execution in the context of the host kernel."

So much for #Capsicum in #FreeBSD #bhyve.

This is exactly why I warn against the continued marketing of Capsicum as the security silver bullet.

This also shows why hypervisors don't increase security; rather, they decrease overall security posture.