Linux KVM/x86 stale SMM MMIO cache bypasses write tracking
A guest can make a tracked RAM write look like KVM_EXIT_MMIO, so a VMM may change the page without write tracking.
Stories per day · 30 days
2 stories, newest first · one card per story
Stories tagged #mmio
GNU GRUB 2.14: serial-MMIO lockdown bypass in Canonical-signed gcdx64.efi
Canonical-signed GRUB2 serial command accepts arbitrary MMIO addresses, letting local attackers with grub.cfg control bypass Secure Boot lockdown.