Hunting and Exploiting Recursive MMIO Flaws in QEMU KVM
summary
Finds and weaponizes a class of QEMU/KVM recursive MMIO bugs where DMA writes re-enter MMIO handlers, causing use‑after‑free, OOB and infinite recursion. Uses CodeQL to automatically find paths and a concrete primitive in Intel HDA plus NVMe flaws: a timer UAF and a PRP-driven stack overflow. Builds an exploit chain that leaks guest RAM, occupies freed timer structures and hijacks a timer callback to reach host code, and releases PoC; recommends bus checks and per‑device busy flags.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:02Backgrounds about Kumu and Kvm
- 1:27Level Architecture View of Kvm with Qmu
- 2:05What Is Recursive Mmo
- 3:32Indirect Recursion
- 13:13Stack Overflow Bug
- 20:51Thoughts about Bug Hunting and the Open Source Security
related talks
35mScavenger: Misuse Error Handling Leading to Qemu/KVM Escape
33mExploring a New Class of Kernel Exploit Primitive
27m3d Red Pill: A Guest-to-Host Escape on QEMU/KVM Virtio Device
51mExploiting Hardware Glitches And Side Channels In Perfect Software
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
40mEvils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIs
53mXenpwn: Breaking Paravirtualized Devices
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...