Not sure this is the right place to post this, but since it's a possible error in the VirtualBox manual, I figured this was probably the closest-to-correct place.
https://www.virtualbox.org/manual/ch13.html#sec-rec-cve-2018-3646 currently suggests disabling nested paging for mitigating Foreshadow, stating that when nested paging is disabled, "[i]t is no longer possible for the guest to insert anything fishy into the page tables, since the VMM carefully validates each entry before shadowing it." From what I've heard from other virtualization security engineers though, nested paging is generally beneficial for security, and disabling nested paging increases attack surface. For instance, as of 2026-07-28, Xen has officially deprecated x86 shadow paging because of denial-of-service risks (https://xenbits.xenproject.org/xsa/advisory-495.html), and there have been lax checks in Xen's shadow paging implementation that could potentially have allowed a VM escape (https://xenbits.xen.org/xsa/advisory-430.html). Does Oracle simply trust its implementation of shadow paging more than it generally trusts CPUs to implement nested paging safely? Or is the advice to disable nested paging outdated and potentially more of a hazard than a hardening measure now? If the latter, the manual probably should be updated. -- Aaron
pgp16rTL5Z9bR.pgp
Description: OpenPGP digital signature
_______________________________________________ vbox-dev mailing list [email protected] https://www.virtualbox.org/mailman/listinfo/vbox-dev
