In this paper, we present an approach to attackon the Xen hypervisor utilizing return-oriented programming(ROP). It modifies the data in the hypervisor that controlswhether a VM is privileged or not and thus can escalatethe privilege of an unprivileged domain (domU) at runtime. As ROP technique makes use of existed code to implementattack, not modifying or injecting any code, it canbypass the integrity protections that base on code measurement. By constructing such kind of attack at the virtualizationlayer, it can motivate further research work towardspreventing or detecting ROP attack on the hypervisor.
['Baozeng Ding', 'Yanjun Wu', 'Yeping He', 'Shuo Tian', 'Bei Guan', 'Guowei Wu']
Return-Oriented Programming Attack on the Xen Hypervisor