What's alarming about this is that it's suggestive of attacks that will work in many PaaS environments and allow an attacker who's hired service for one deployment to escape to the hypervisor and take control of systems deployed by other customers. A compromised hypervisor is Decartes evil genius. Except without the interest in deluding you about your own existence.
I think the biggest problem is that the solution require hardware support that was only added on the client side with Sandy Bridge that was only released at around the beginning of this year. Considering that the paper says that VT-d can't be done securely without this hardware support, this means two generations worth of Intel hardware that has VT-d but can't use it securely!
"You've been smoking something really mind altering, and I think you
should share it.
x86 virtualization is about basically placing another nearly full
kernel, full of new bugs, on top of a nasty x86 architecture which
barely has correct page protection. Then running your operating
system on the other side of this brand new pile of shit.
You are absolutely deluded, if not stupid, if you think that a
worldwide collection of software engineers who can't write operating
systems or applications without security holes, can then turn around
and suddenly write virtualization layers without security holes.
You've seen something on the shelf, and it has all sorts of pretty
colours, and you've bought it." [1]
