On Mon, Jan 21, 2019 at 01:39:34AM +0200, Ahmed Abd El Mawgood wrote: >This patch introduces a hypercall that can assist against subset of kernel >rootkits, it works by place readonly protection in shadow PTE. The end >result protection is also kept in a bitmap for each kvm_memory_slot and is >used as reference when updating SPTEs. The whole goal is to protect the >guest kernel static data from modification if attacker is running from >guest ring 0, for this reason there is no hypercall to revert effect of >Memory ROE hypercall. This patch doesn't implement integrity check on guest >TLB so obvious attack on the current implementation will involve guest >virtual address -> guest physical address remapping, but there are plans to >fix that. Hello Ahmed, I don't quite understand the attack. Do you mean that even one guest page is protected by ROE, an attacker can map the virtual address to another unprotected guest page by editing guest page table? Thanks Chao
