[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <9f3fea37-315d-4dd1-b03b-7426f011f57b@gmail.com>
Date: Mon, 30 Mar 2026 13:16:23 -0400
From: Demi Marie Obenour <demiobenour@...il.com>
To: oss-security@...ts.openwall.com, Sandipan Roy <saroy@...hat.com>
Cc: Paolo Bonzini <pbonzini@...hat.com>, denis.pilipchuk@...cle.com,
bkov@...zon.com, fgriffo@...zon.com, Yogesh Mittal <ymittal@...hat.com>,
Mauro Matteo Cascella <mcascell@...hat.com>
Subject: Re: KVM shadow EPT stale rmap use-after-free
On 3/30/26 02:04, Sandipan Roy wrote:
> Hello OSS-Sec,
>
> Alexander Bulekov(bkov@...zon.com) and Fred Griffoul (fgriffo@...zon.com)
> reported a use-after-free in KVM's shadow paging code. The issue was found
> through fuzzing. It is exploitable from any x86 guest with nested virtualization enabled,
> on either Intel or AMD processors, or using shadow paging (ept=0 /
> npt=0). The bug leads to kernel memory corruption and DoS issues.
Was this part of Amazon's work to enable nested virtualization on AWS?
> On kernels 6.16 and newer the reproducer also triggers a WARN, present
> since commit 11d45175111d ("KVM: x86/mmu: Warn if PFN changes on
> shadow-present SPTE in shadow MMU").
Does the WARN happen before any memory corruption? In other words,
is panic_on_warn a mitigation?
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
