Security: VMware ESX Server AMD fxsave/fxrstor vulnerability

VMware released a security bulletin about a security vulnerability affecting its flagship product: ESX Server:

The instructions fxsave and fxrstor on AMD CPUs are used to save or restore the FPU registers (FOP, FIP and FDP). On AMD Opteron Processors, these instructions do not save/restore some exception related registers unless an exception is currently being serviced. This can lead to a security hole that allows local attackers to monitor the execution path of FPU processes, possibly allowing them to obtain sensitive information being passed through those processes.

This vulnerability exists for all AMD Athlon, Duron, Athlon MP, Athlon XP, Athlon64, Athlon64 FX, Opteron, Turion, and Sempron processors but the AMD Opteron processors are the only AMD processors supported with ESX Server.

It only affects version 3.0.0 and patch ESX-2533126 has already been issues.

Check details for patching procedure here.

The vulnerability is actually related with a Linux kernel bug prior to 2.6.16.9. More details are available here.

Security: Parallels Desktop for Mac Insecure File Permissions

Secunia reported a security advisory about file permissions issue with Parallels Desktop:

The security issue is caused due to /Library/StartupItems/Parallels/prl_dhcpd creating the file “/Library/Parallels/.dhcpd_configuration” with insecure file permissions (set to 666).

The security issue is reported in Parallels Desktop for Mac Build 1940. Other versions may also be affected.

No patch is available at the moment of writing. Check the advisor for updates at source.

Tech: Installing Windows Vista RTM ISO on VMware Server

Microsoft Windows Vista finally made its way to MSDN subscriptions (and warez circuits…) and within a couple of months the whole world will be able to access it.

A virtual machine is the very first place where to try a new operating system, even if in this case virtualization products (VMware, Microsoft, Parallels) will not be able to show you the new graphic interface Aero.

At the moment of writing none of existing platforms is supporting Vista as host or guest OS, but current beta versions (Microsoft Virtual PC 2007 and VMware Workstation 6.0) do the trick.
A Microsoft Virtual PC 2007 public beta is available now, while for one of VMware Workstation 6.0 you’ll have to wait December. Parallels Workstation is expected as well to support Vista very soon.

While waiting for these updates, Jason Brooks of eWeek Labs, posted a nice suggestion to install Vista RTM on VMware Server 1.0.1 starting from the ISO.
Read it here.

Server virtualization meets grid computing

GRIDtoday published an interesting interview with Kate Keahey, an Argonne National Laboratory scientist working on the Globus Toolkit and other aspects of Grid technology, about how server virtualization can serve distributed computing purposes:


Gt: Virtualization and distributed computing seem to permeate everything in IT today. Tell us about some of the ways virtualization is converging with distributing computing and how Grid technology fits in.

KEAHEY: I think of virtualization as a vehicle to realize the dream of Grid computing — obtaining on-demand computational resources from distributed sources in the same simple and intuitive way we get electricity today. Today, in order to run a job on the grid a user has to identify a set of platforms capable of running that job by virtue of having the right installation of operating system, libraries, tools, and the right configuration of environment variables, etc. In practice, this means that the choice of platforms will either be limited to a very narrow set, or the job first has to be made compatible with an environment supported by a large resource provider, such as TeraGrid. For some applications this is a significant hurdle. Furthermore, even if you do manage to identify such an environment, it is hard to guarantee that the resource will be available when needed, for as long as needed, and that the user will gets his or her fair share of that resource.

Virtualization introduces a layer of abstraction that turns the question around from “let’s see what resources are available and figure out if we can adapt our problem to use them” to “here is an environment I need to solve my problem — I want to have it deployed on the grid as described.” For a user this is a much simpler question. The issue is whether we can implement the middleware that will map such virtual workspace onto physical resources. One way to implement it would be to provide an automated environment installation on a remote node.

But what really gives this idea a boost is using virtual machine technology to represent such a workspace. This makes the environment easy to describe (you just install it), easy to transport, fast to deploy and, thanks to recent research, very efficient. Best of all, virtual machine management tools nowadays allow you to enforce the resource quantum assigned to a specific virtual machine very accurately — so you could for example test or demo your application in a virtual cluster making sparing use of resources, and redeploy the virtual cluster on a much more powerful resource for production runs. This is another powerful idea behind virtualization: the environment is no longer permanently tied to a specific amount of resource but rather this resource quantum can be adjusted on-demand.

Similarly, we can define virtual storage and implemented using distributed storage facilities, or overlay networks implemented on top of networking infrastructure. We can compose those constructs to put together whole “virtual grids” and test their operation before requesting serious resource allocations. There are many exciting ongoing research efforts in this area and some of them will be represented at the VTDC workshop.

Further down the road, if the idea of running virtual machines becomes ubiquitous, we may find other ways of leveraging the fact that we can have more than one isolated “hardware device” on a physical resource. We could use it to host physical devices requiring isolation for security reasons. We could carry around pluggable virtualized environments the way we carry laptops today. We could rely on migration to a greater extent to provide uninterrupted services. All those potential applications will come more clearly in focus once we see how widespread the appeal of virtual machines will prove in practice….

Read the whole interview at source.

I already covered this topic in January 2006, with my old Virtualization is the first step of a long walk called Grid Computing.

Opsware announces Virtualization Director

Quoting from the Opsware official announcement:

Opsware Inc., the leading provider of Data Center Automation software, today announced the introduction of Opsware Virtualization Director, the industry?s first integrated solution that seamlessly manages the complete lifecycle of both physical and virtual servers to enable management on an enterprise scale.

Opsware Virtualization Director provides comprehensive virtual server lifecycle management to accelerate enterprise deployments by seamlessly managing across physical servers and environments virtualized with technologies such as VMware, Microsoft Virtual Server, Sun Solaris 10, XenSource and others. Initially, Opsware Virtualization Director will support VMware and Solaris 10; support for other environments is expected to be added in the future. Opsware Virtualization Director?s integrated capabilities include:

  • Creation
    provision, activate and delete virtual servers on a large scale basis
  • Control
    start, stop, suspend and resume virtual servers as required
  • Visualization
    discover and view dependencies between applications, servers, network devices and storage
  • Tracking
    track relationships between virtual machines and their hosts and the applications they support; perform change impact assessments between applications, servers, network devices and storage
  • Standardized management
    seamless management across virtual and physical servers and networks encompassing the entire lifecycle, including patching, configuration, software deployment, audit and compliance, reporting, and best practices and policy-enforcement for the entire environment.

The Opsware Virtualization Director will be generally available as part of Opsware System 6 in the first quarter of calendar 2007…

Scalent too may be soon involved in Virtualization Director evolutions since the company entered the Opsware Technology Alliance Partner Program as charter member.

The virtualization.info Virtualization Industry Roadmap has been updated accordingly.

XenSource launches ISVs / IHVs Partner Program

After launching a Channel Partner Program in August, XenSource is now working on alliances with software and hardware vendors worldwide.

Quoting from the XenSource official announcement:

XenSource, Inc., the leader in infrastructure virtualization solutions based on the open source Xen? hypervisor, today introduced a partner program that will leverage relationships with independent software vendors (ISVs) and independent hardware vendors (IHVs) to develop high performance products for virtualized environments based on Xen technology.

The new program will offer companies three level of participation, each providing a level of integration that best suits the member company:

  • Technology Partners
    for companies interested in increasing awareness of the virtualization support provided by their products through the XenSource website partner pages, which will highlight solutions by category.
  • Premier Partners
    for companies seeking a more integrated marketing strategy that includes joint PR and branding; shared collateral such as white papers, case studies, and solution descriptions; and participation at XenSource user conferences. Additionally, XenSource will invest in co-marketing initiatives including channel partnerships and interoperability and compliance testing.
  • Strategic Partners
    for companies committed to XenSource technology, this level of partnership is by invitation only and includes long-range, fundamental engineering interactions; development and optimization activities; and co-marketing initiatives including channel tie-ins.

All partners will have early access to technical specifications, and participate in the XenEnterprise Beta programs. There is no fee for charter members who join by December 1, 2006. For more information or to apply for the program, go to www.xensource.com/partners

Charter members include:

  • IHVs
    AMD, Azul Systems, Brocade, Emulex, Intel, Isilon Systems, QLogic, SuperMicro, Tehuti Networks and Verari Systems
  • ISVs
    Availigent, Avinti, Avocent, Cassatt, Citrix, CohesiveFT, ConVirt, Embotics, Enigmatec, Enomaly, Evident Software, Hyperic, Ingres, Klir Technologies, LeoStream, Marathon Technologies, Microsoft Corp., Mountain View Data, PlateSpin, Platform, Propero, Provment, Qlusters, rPath, SignaCert, Sphera, SteelEye Technology, ToutVirtual, Transitive, uXcomm, Verari Systems Software, Virtual Appliances, VMLogix, Voltaire, and Zmanda

Several of these charter members announced efforts to support XenEnterprise in their current products. Among them:

Emulex announces HBA management software for Microsoft Virtual Server 2005

Quoting from the Emulex official announcement:

Emulex Corporation today announced VMPilot, a new management software application for Microsoft Virtual Server 2005 environments. The Emulex VMPilot is designed for simplified creation and migration of virtual machines attached to storage area networks (SANs). Employing Emulex’s 4Gb/s Fibre Channel host bus adapters (HBAs) with its industry-leading LightPulse Virtual HBA technology, VMPilot is designed to allow administrators to seamlessly deploy and migrate SAN-based virtual machines, while leveraging their existing SAN management tools and best practices.

A simple wizard creates virtual machines with SAN connectivity using virtual HBA ports that work like physical HBAs.

VMPilot also easily migrates virtual machines to alternate physical servers while maintaining their SAN attachment, saving storage managers from the time and effort of reconfiguring storage and fabrics or copying files. In addition, VMPilot allows storage managers to isolate applications and comply with service level agreements. VMPilot is in beta release and is scheduled to be available during the first quarter of 2007…

LynuxWorks unveils LynxSecure Separation Kernel on Intel VT

Quoting from the LynuxWorks official announcement:

Raising the bar for embedded software security and safety once again, LynuxWorks, Inc., today announced LynuxWorks’ LynxSecure, the first embedded separation kernel with multiple independent levels of security (MILS), on Intel’s Virtualization Technology.

LynxSecure supports Symmetric MultiProcessing (SMP) and 32-bit/64-bit addressing for high-end scalability. LynxSecure will be certifiable to both Common Criteria EAL 7 and DO-178B level A, and its separation technology puts it in a unique place to attain these certifications…

Whitepaper: Altiris SVS 2.0 Technology Audit

The Butler Group research firm released a 7-pages technical analysis paper about Altiris Software Virtualization Solution (SVS) 2.0, providing this conclusion:

Altiris SVS is a well developed solution to combating ‘DLL hell’ in the Windows environment, however, it also provides an excellent tool for ensuring that desktop management is optimised and support costs minimised. Offering organisations a different approach to managing applications on the desktop, Altiris SVS represents a significantly different perspective to that offered by hardware virtualisation solutions. Application virtualisation lacks the resource balancing capabilities offered with hardware virtualisation, but Altiris has worked closely with VMWare so its SVS product operates in a physical or virtual hardware environment where it benefits from the resource balancing capabilities offered by products such as VMWare Infrastructure 3. This capability makes Altiris SVS a versatile solution that provides organisations with management tools to perform desktop operating system migrations and desktop application management simpler and more cost effective.

Butler Group considers that Altiris SVS meets the requirements of managing the desktop applications extremely well; we particularly like the simple filter driver approach to virtualising the applications as this removes the need for organisations to change the infrastructure to accommodate the move to a virtual world. Butler Group believes the weaknesses in the product, especially the lack of support for thin client, server applications, and operating system patch management, are all of secondary importance. Altiris has stated that many of these will be supported by the next major release of SVS scheduled for mid 2007.

It’s very short and seems more a small review (excluding title page, summary page and contact page it’s just a 4-pages brief overview) than a technical assessment. But Altiris claims this is an independent analysis so someone may want to take a look.

Download it here.