Changeset 57609 in vbox for trunk

Timestamp:

Sep 3, 2015 11:58:45 AM (9 years ago)

Author:

vboxsync

Message:

manual: rephrased the comment.

Location:

trunk/doc/manual/en_US

Files:

• user_GuestAdditions.xml (modified) (1 diff)
• user_Security.xml (modified) (1 diff)

trunk/doc/manual/en_US/user_GuestAdditions.xml

@@ -1857 +1857 @@
         linkend="metrics" /> for information on how to query metrics.</para>
 
-      <note><para>Enabling Page Fusion might improve the chances for malicious
-       guests to successfully attack other VMs running on the same host using
-       side-channel attacks, see <xref linkend="pot-insecure"/>.</para></note>
+      <note><para>Enabling Page Fusion might indirectly increase the chances
+      for malicious guests to successfully attack other VMs running on the
+      same host, see <xref linkend="pot-insecure"/>.</para></note>
     </sect2>
   </sect1>

trunk/doc/manual/en_US/user_Security.xml

@@ -330 +330 @@
         <listitem>
           <para>When Page Fusion (see <xref linkend="guestadd-pagefusion"/>)
-          is enabled, a malicious guest doing a side-channel attack could be
-          able to determine the address space layout of another guest running
-          on the same host. This would improve the chances of the malicious guest
-          to take advantage of other attack vectors he might have against the
-          target VM. To prevent potential malcious guest process from doing
-          such side-channel attacks, Page Fusion should be disabled.</para>
+          is enabled, it is possible that a side-channel opens up that allows
+          a malicious guest to determin the address space layout (i.e. where
+          DLLs are typically loaded) of one other VM running on the same host.
+          This information leak in it self is harmless, however the malicious
+          guest may use it to optimize attack against that VM via unrelated
+          attack vectors.  It is recommended to only enable Page Fusion if you
+          do not think this is a concern in your setup.</para>
         </listitem>