Hacker News Reader

> Assuming our guest can get full unrestricted access to any MSR (which is only a question of timing thanks to init_on_alloc=1 being the default for most modern distributions)

Can someone elaborate on how init_on_alloc would be helpful to an attacker?

View on HN

My guess is because the exploit requires zeroing out an ACL bitmap that the host uses to control MSR access, and init_on_alloc zeroes out memory as it's allocated, which is the state you want as an attacker here.

I wonder if KASAN could've helped here.

It's a toctou bug, so probably not.

Reply on news.ycombinator.com