4 ms·
TL;DR: If you can force emulation of the LGDT or LIDT instructions, you can replace the global memory segment descriptor table or interrupt descriptor table (re
by pklausler 10y ago
TL;DR: If you can force emulation of the LGDT or LIDT instructions, you can replace the global memory segment descriptor table or interrupt descriptor table (resp.), since the instruction emulation code fails to check permissions properly.
- dice 10y agoAlso this is privilege escalation within the DomU (guest), it does not break out into the Dom0 (hypervisor). It looks like he'll do one of those next, though. The last paragraph in TFA: > A future blog post will talk about a guest-to-host escape, with a working exploit. Stay tuned!