Dark Mode
Capec-480 Detail
Escaping Virtualization
Standard Software Likelihood: Low Typical Severity: Very High
Parents: 115
Children: 237
An adversary gains access to an application, service, or device with the privileges of an authorized or privileged user by escaping the confines of a virtualized environment. The adversary is then able to access resources or execute unauthorized code within the host environment, generally with the privileges of the user running the virtualized process. Successfully executing an attack of this type is often the first step in executing more complex attacks.
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-480 | capec | https://capec.mitre.org/data/definitions/480.html | |
| CWE-693 | cwe | http://cwe.mitre.org/data/definitions/693.html | |
| T1611 | ATTACK | https://attack.mitre.org/wiki/Technique/T1611 | Escape to Host |
Explore
-
Probing: The adversary probes the target application, service, or device to find a possible weakness that would allow escaping the virtualized environment.
| Techniques |
|---|
| Probing applications, services, or devices for virtualization weaknesses. |
Experiment
-
Verify the exploitable security weaknesses: Using the found weakness, the adversary attempts to escape the virtualized environment.
| Techniques |
|---|
| Using an application weakness to escape a virtualized environment |
Exploit
-
Execute more complex attacks: Once outside of the virtualized environment, the adversary attempts to perform other more complex attacks such as accessing system resources or executing unauthorized code within the host environment.
| Techniques |
|---|
| Executing complex attacks when given higher permissions by escaping a virtualized environment |
Not present
Not present
Not present
| Authorization | Access Control | Accountability | Authentication | Non-Repudiation |
|---|---|---|---|---|
| Bypass Protection Mechanism | Bypass Protection Mechanism | Gain Privileges | Gain Privileges | Gain Privileges |
| Execute Unauthorized Commands (Run Arbitrary Code) | ||||
| Gain Privileges |
Not present