Scavenger: Misuse Error Handling Leading to Qemu/KVM Escape
summary
Directed greybox fuzzing of QEMU’s NVMe device finds an uninitialized free in nvme_map_prp caused by misused error-handling goto cleanup paths. The researchers use a goto-target backward slice to guide AFL-style fuzzing, then build a cross-domain primitive by crafting fake heap chunks in guest-mapped memory and abusing host-side mmapped guest pointers to leak heap and function addresses. They turn that UAF into a guest-to-host escape that pops a host calculator, and the bug is fixed in QEMU 5.2.0.
AI-written summary · about
chapters (9)
- 0:00Start
- 3:49Insightful CVE-2020-25084: USB use-after-free
- 6:05QEMU - Error Handling Code Error Handling Code
- 8:00Error Handling Code Directed Greybox Fuzzing
- 9:36Scavenger - Uninitialized Free Vulnerability
- 15:151st path: Uninitialized Stack Variable
- 20:01Interesting Structure on Virtio-gpu
- 22:12High-Level Overview What if we free a fake chunk in guest?
- 33:19Further Analysis of Cross Domain Attack
related talks
22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVM
27m3d Red Pill: A Guest-to-Host Escape on QEMU/KVM Virtio Device
26mFuzzing Host-to Guest Attack Surface in Android Protected KVM
56mA Retrospective Case Study of VMware Guest-to-Host Escape Vulnerabilities
38mUnmapped Private Memory for Confidential Guests
53mXenpwn: Breaking Paravirtualized Devices
29mVirtual Device Fuzzing Support in QEMU
41mEscaping Virtualized Containers