On 3/30/26 02:04, Sandipan Roy wrote: > Hello OSS-Sec, > > Alexander Bulekov([email protected]) and Fred Griffoul ([email protected]) > reported a use-after-free in KVM's shadow paging code. The issue was found > through fuzzing. It is exploitable from any x86 guest with nested > virtualization enabled, > on either Intel or AMD processors, or using shadow paging (ept=0 / > npt=0). The bug leads to kernel memory corruption and DoS issues.
Was this part of Amazon's work to enable nested virtualization on AWS?
> On kernels 6.16 and newer the reproducer also triggers a WARN, present
> since commit 11d45175111d ("KVM: x86/mmu: Warn if PFN changes on
> shadow-present SPTE in shadow MMU").
Does the WARN happen before any memory corruption? In other words,
is panic_on_warn a mitigation?
--
Sincerely,
Demi Marie Obenour (she/her/hers)
OpenPGP_0xB288B55FFF9C22C1.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
