Xenpwn: Breaking Paravirtualized Devices
summary
Research uses Xenpwn with nested virtualization, LibVMI memory introspection, Capstone disassembly and a zero-trace storage backend to trap EPT violations on shared pages and generate memory-access traces. Results show multiple critical double fetch bugs in Xen paravirtualized backends—block and disk backends allow out‑of‑bounds reads/writes, and a PCI backend compile-optimization-induced double fetch yields a type‑confusion path to a one‑shot write primitive and a full VM→host breakout demonstrated end‑to‑end.
AI-written summary · about
chapters (20)
- 0:00Introduction and agenda
- 2:59Device virtualization
- 5:52Paravirtualized devices
- 9:18Security attack surface
- 12:09Challenges in security
- 15:10Double fetch vulnerabilities
- 17:10History of double fetch
- 20:21Boxpound research
- 22:50Tool architecture
- 25:59Trace collection and storage
- 29:11Vulnerability detection
- 31:02Tool limitations
- 32:52Test results
- 34:05QEMU disk vulnerability
- 36:04Block back vulnerability
- 36:55PCI back vulnerability
- 39:29Exploitation walkthrough
- 42:04Mutex lock exploitation
- 45:32Code execution and breakout
- 48:03Live demo and conclusion
related talks
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
55mLessons Learned from Eight Years of Breaking Hypervisors
22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVM
56mA Retrospective Case Study of VMware Guest-to-Host Escape Vulnerabilities
33mExploring a New Class of Kernel Exploit Primitive
41mSecuring Your Xen-Based Cloud
37mAttacking The XNU Kernel In El Capitain
33mByepervisor: How We Broke The PS5 Hypervisor