QEMU: user-to-root privesc inside VM via bad translation caching
https://bugs.chromium.org/p/project-zero/issues/detail?id=1122 [bugs.chromium.org]
2017-03-23 22:43
However, while real X86 processors have a maximum instruction length
of 15 bytes, QEMU’s instruction decoder for X86 does not place any
limit on the instruction length or the number of instruction prefixes.
Therefore, it is possible to create an arbitrarily long instruction
by e.g. prepending an arbitrary number of LOCK prefixes to a normal
instruction. This permits creating a basic block that spans three
pages by simply appending an approximately page-sized instruction to
the end of a normal basic block that starts close to the end of a
page.
source: grugq