This past weekend, there was some online discussion about security flaws in the Xen open source hypervisor. Specifically, it was reported that there is a vulnerability in Xen which can be exploited by malicious, local users to gain escalated privileges.

I want to make sure everybody who is using Virtual Iron or is thinking of using Virtual Iron knows that this flaw does not impact Virtual Iron software at all.

The vulnerability mentioned is caused due to an input validation error in tools/pygrub/src/GrubConf.py. This can be exploited by "root" users of a guest domain to execute arbitrary commands in domain 0 via specially crafted entries in grub.conf when the guest system is booted. Source: http://www.secunia.com/advisories/26986/

While Virtual Iron incorporates the Xen open source hypervisor, our software is not impacted by this vulnerability at all.
- Virtual Iron does not grant any user access to dom0.
- Virtual Iron does not use GrubConf.py. It is not even present in our dom0.
- Virtual Iron supports only unmodified operating systems (HVM). GrubConf.py is used to bootstrap paravirtualized guests.

Questions? Let us know here or in the forums.