Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Every LLM bug in the Linux kernel (warehouse rave edit).
(This comment is a reference to https://youtu.be/v1Mfirg2-Z8
by inigyou - Another serious critical vulnerability that almost no-one cares about, when they should.by rvz
- Oh yay another one lol. This one seems much more general than the prior one that needed nested page tables.
Patch Thursday for cloud VM ppl lol
by minimaltom - Doesn't this one need it as well? I see the shadow mmuby tryauuum
- Do most cloud providers have live-migration or what is the approach to make this seamless? What kind of interruption might tenants notice?by metadat
- This one exploit "shadow MMU" in the nested virtualization path of KVM, so this one is more-limited than EPT/NPT vul'n (KVM defaults to EPT/NPT, nested virt'n is disabled by default).
Nested virtualization is rather a niche feature, and, tbh, considering that shadow MMU is highly complicated legacy code (i.e. outside of the main happy path) and has been source of critical vul'n, I would avoid nested virtualization on KVM.
by esjeon - > Q: Do you think KVM vulnerabilities will keep appearing?
> A: Yes. I recommend establishing a sustainable patching process for host hypervisors. Winter is coming.
by voidmain - In seL4, a VMM escape, hard as that'd be, yields nothing.
VMM handles all VM exceptions, and is just another user program. It has no higher capabilities than the VM itself.
by snvzz - Anyone know if "-cpu ${CPU},vmx=off,svm=off" in QEMU is a safe workaround for this?
(To disable nested virtualization on a per-VM basis. Only against exploitation from within that specific VM, obviously does nothing against users with access to /dev/kvm on the host.)
[That did work around Januscape: https://news.ycombinator.com/item?id=48815819]
by eqvinox - This one(Zapscape) exploits the same module(shadow MMU) as Januscape, so it does workaround the issue.
AFAIK the only code paths that activates shadow MMU are (1) lack of hardware EPT/NPT support (2) nested virtualization. Hiding `vmx`/`svm` prevents access to the second code path.
by esjeon