Exploiting Interfaces of SEV-ES-protected Virtual Machines
summary
Covers AMD SEV-ES in Linux 5.10 and shows concrete hypervisor-side attacks that abuse VM–hypervisor interfaces not protected by SEV-ES. Demonstrates four exploits using virtual devices, manipulated CPUID/RDTSC, forged MMIO regions, and induced stack decryption plus ROP to extract keys, reduce entropy of kernel defenses, leak or inject code, and achieve arbitrary code execution, and describes how the interfaces were hardened to mitigate these issues.
AI-written summary · about
related talks
33mAMD Encrypted Virtualization Update
55mLessons Learned from Eight Years of Breaking Hypervisors
51mExploiting Hardware Glitches And Side Channels In Perfect Software
25mProtecting from MaliciousHypervisor Using AMD SEV-SNP
49mBreaking Hardware-Enforced Security With Hypervisors
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
30mEnabling AMD SEV in Xen
50mExploiting the Hyper-V IDE Emulator to Escape the Virtual Machine