rust-vmm: A Security Journey
summary
rust-vmm provides modular Rust crates for virtualization and enforces security with cargo-audit scans, one-crate-per-component packaging, and documented unsafe APIs; development reduces external deps and maintains several zero-dependency crates. A concrete bug class in the serial console allows unbounded FIFO growth and host-disk exhaustion; fixes are to limit input fifo (returning errors when full) and to rate-limit output with a fixed-size ring buffer or named pipe. Component fuzzing targets virtio (virtio-blk first) with a GSoC 2021 mock framework that builds descriptor chains and injects arbitrary data.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:21A Short Intro
- 1:04Components - Examples
- 2:29Security Journey
- 2:49Organization Setup
- 4:07Audit for Vulnerabilities
- 5:17Development
- 7:16Reduce Unsafe Code
- 8:30Documentation
- 9:44Overly Simplified Operation Mode
- 13:00Serial Console – Threat Model (2)
- 14:47Fuzzing Virtualization Components
- 16:34Preparing Virtio Components for Fuzzing
- 18:32Reporting Security Vulnerability
