Hunting and Exploiting Recursive MMIO Flaws in QEMU KVM скачать в хорошем качестве

Hunting and Exploiting Recursive MMIO Flaws in QEMU KVM

When a hypervisor handles MMIO VM-exit to do DMA transfers, the same MMIO handler might be called later if the destination overlaps with its MMIO region. This kind of bug can damage the virtual device's state machine and even crash the hypervisor. However, little effort has been spent to study whether they are critical security issues – Are they exploitable? In this talk, we will present our security research on QEMU/KVM, a hypervisor widely used in cloud computing, and analyze the root cause and common consequences of recursive MMIO, thus disclosing a new attack surface. By: Qiuhao Li, Gaoning Pan, Hui He & Chunming Wu Full Abstract & Presentation Materials: https://www.blackhat.com/asia-22/brie...