3d Red Pill: A Guest-to-Host Escape on QEMU/KVM Virtio Device
summary
Demonstrates a working guest-to-host escape on QEMU/KVM by exploiting virtio-gpu: a protobuf-guided, structure-aware fuzzer finds a null-deref DoS and a CVE-class heap buffer overflow that becomes an arbitrary-write. Uses protobuf-guided fuzzing and performance profiling to speed coverage, triggers vulnerable APIs from the guest via ioctl through libdrm, leaks host addresses by mapping host resource buffers into the guest, then arranges heap layout so the overflow overwrites a renderer function pointer and turns into an arbitrary write primitive to execute code on host.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 7:50Structure aware fuzzing
- 10:27Performance analysis
- 13:26Bug analysis
- 16:21Exploit
- 18:49Solution
- 20:17Memory Mapping
- 22:59Overwrite
related talks
35mScavenger: Misuse Error Handling Leading to Qemu/KVM Escape
22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVM
56mA Retrospective Case Study of VMware Guest-to-Host Escape Vulnerabilities
26mFuzzing Host-to Guest Attack Surface in Android Protected KVM
29mVirtual Device Fuzzing Support in QEMU
48mStraight Outta VMware: Modern Exploitation of the SVGA Device for Guest-to-Host Escapes
44mFor the Greater Good: Leveraging VMware's RPC Interface for fun and profit
36mExploiting Buffer Overflows on RISC-V