Saint Matryoshka Trap, Trap Within the Trap

Patron of QEMU device emulation, controllers that write to themselves, and virtual machines that want out.

Life

In May 2022 researchers described the Matryoshka Trap: a set of "DMA reentrancy" flaws in QEMU's device emulation, starting with the USB EHCI controller. A guest could make a DMA transfer write into the registers of the very same controller, triggering nested actions like Russian dolls, up to corrupting the emulator's state and attempting an escape from the virtual machine to the host.

Prayer

O Saint Matryoshka Trap, who hides one attack inside another, let our emulated devices not write upon themselves. Amen.

How to celebrate

Celebrated by updating QEMU and checking that a DMA transfer does not land in the registers of the one running it.

Inside every trap, another trap.