An EPYC escape: Case-study of a KVM breakout

Re:An EPYC escape: Case-study of a KVM breakout by SubzeroCarnage on Tuesday June 29, 2021 @03:51PM (#27680886)

> Assuming our guest can get full unrestricted access to any MSR (which is only a question of timing thanks to init_on_alloc=1 being the default for most modern distributions)

Can someone elaborate on how init_on_alloc would be helpful to an attacker?

[ Parent | on HN ]

Re:An EPYC escape: Case-study of a KVM breakout by tptacek on Tuesday June 29, 2021 @05:05PM (#27681727)

My guess is because the exploit requires zeroing out an ACL bitmap that the host uses to control MSR access, and init_on_alloc zeroes out memory as it's allocated, which is the state you want as an attacker here.

[ Parent | on HN ]

Re:An EPYC escape: Case-study of a KVM breakout by ece on Tuesday June 29, 2021 @05:50PM (#27682175)

I wonder if KASAN could've helped here.

[ Parent | on HN ]

Re:An EPYC escape: Case-study of a KVM breakout by strstr on Tuesday June 29, 2021 @11:13PM (#27684452)

It's a toctou bug, so probably not.

[ Parent | on HN ]