Breaking Isolation: A New Perspective on Hypervisor Exploitation via Cross-Domain Attacks

Breaking Isolation: A New Perspective on Hypervisor Exploitation via Cross-Domain Attacks

Speakers: Gaoning Pan

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=CrvRW9cJFKg

Overview

Virtual machine escape from hypervisors like QEMU and VirtualBox is one of the most consequential exploit classes in cloud security. This talk introduces cross-domain attacks, a systematic exploitation technique that makes previously unexploitable pointer corruption vulnerabilities in hypervisors practically exploitable. The key insight: guest VM memory is mapped into host address space, and the attacker fully controls guest memory. By redirecting corrupted pointers from the host address space into guest memory, attackers can construct fake objects with function pointers and capability fields entirely under their control, bypassing ASLR and the need to understand host memory layout.

The researchers built an automated exploitation framework that takes a non-exploitable pointer corruption vulnerability and source code as input and generates a working proof-of-concept exploit. Applied to real vulnerabilities, the framework successfully exploited 15 previously hard-to-exploit vulnerabilities across QEMU and VirtualBox. The team identified 772 cross-domain gadgets in QEMU clustered into eight major families, demonstrating that the guest-to-host address translation functions needed for the attack are abundant throughout device emulation code.

Background

▶ Watch: Hypervisor exploitation barriers: ASLR and host memory layout (0:00)

Hypervisors are foundational to cloud infrastructure, providing the isolation boundary between virtual machines belonging to different tenants. When a hypervisor is compromised, the consequences are severe: VM escape allows an attacker in one guest to execute code on the host, potentially accessing other tenants' VMs and undermining the entire isolation model of the public cloud.

The researchers studied open-source QEMU vulnerabilities from 2019 to 2024 and found that pointer corruption is the prevalent vulnerability class. However, many pointer corruption vulnerabilities are considered unexploitable in practice for two reasons: first, the attacker needs to know the memory structure of the object the corrupted pointer references, which requires information about host memory layout; second, ASLR (Address Space Layout Randomization) prevents the attacker from deterministically knowing which address space region the pointer targets.

These barriers have historically relegated many hypervisor vulnerabilities to "theoretical" status. The traditional exploitation approach requires additional information leaks, heap grooming, and significant manual effort for each individual vulnerability. Cross-domain attacks eliminate these barriers by leveraging a property inherent to all hypervisors: guest physical memory is mapped into host virtual address space, and the attacker has full control over guest memory contents.

Key Findings

▶ Watch: Cross-domain gadgets: redirecting corrupted pointers into guest space (4:00)

The central finding is that guest memory serves as a reusable exploitation substrate for hypervisor vulnerabilities. Instead of struggling with host memory layout and ASLR, the attacker redirects corrupted pointers into the guest address space, where they can construct arbitrary fake objects containing function pointers, capability flags, and data fields that the hypervisor will interpret as legitimate internal structures.

The attack works because hypervisor device emulation code routinely translates guest physical addresses to host virtual addresses -- this is the fundamental operation of memory virtualization. These translation functions create what the researchers call cross-domain gadgets: code fragments that already contain guest-to-host virtual address pointers. The researchers identified 772 cross-domain gadget instances in QEMU, clustered into eight major gadget families, distributed across virtually all device emulation modules.

The gadgets are broadly distributed across both stack and heap memory, confirming that cross-domain attacks can be applied regardless of where the corrupted pointer resides. The attack was successfully demonstrated against 15 previously hard-to-exploit vulnerabilities in QEMU and VirtualBox, converting each into a working exploit through the automated framework.

Four attack variants were developed: arbitrary code execution, information leakage, data overwriting, and chunk confusion (for heap exploitation), covering the major exploitation objectives an attacker would need.

Technical Deep Dive

▶ Watch: Four attack variants: code execution, info leak, data overwrite, chunk confusion (6:00)

The cross-domain attack operates in four stages:

Stage 1 - Gadget Identification: Static analysis of hypervisor source code identifies cross-domain gadgets -- code fragments containing guest physical address to host virtual address translations. A gadget is formally defined as a three-tuple: a guest-controllable operand, the guest-to-host address translation site, and the corresponding code path. These are catalogued into a gadget repository.

Stage 2 - Gadget Matching: The corrupted pointer from the vulnerability is matched with compatible gadgets. For stack vulnerabilities, gadgets are matched at compatible stack depths. For heap vulnerabilities, matching considers aligned chunk sizes and offsets so the gadget aligns with the corrupted pointer in memory.

Stage 3 - Trigger Input Discovery: Fuzzing is used to automatically find inputs that trigger the matched gadget along the execution path. The target gadget function is instrumented with assertions, and the fuzzer explores inputs until the entire gadget path is exercised, producing the triggering input.

Stage 4 - Exploit Assembly: The vulnerability's proof-of-concept (which triggers the pointer corruption) is combined with the gadget's triggering input. The guest-to-host virtual address pointer is aligned with the corrupted pointer in memory, and a fake object is constructed in guest memory mimicking the layout the hypervisor expects -- including function pointers, capability flags, and data fields from documentation or source code analysis.

The case study demonstrates exploiting an uninitialized free vulnerability in QEMU's NVMe module. The vulnerability generates an uninitialized free. The pointer is redirected into guest space, so when freed, a fake guest chunk is inserted into the host free list. The attacker then manipulates this chunk to achieve traditional use-after-free or fastbin-style exploitation on the host.

Demo / Proof of Concept

▶ Watch: 772 gadgets in QEMU across eight families, 15 vulnerabilities exploited (10:00)

The automated framework was evaluated against real-world QEMU and VirtualBox vulnerabilities. Starting from non-exploitable pointer corruption vulnerabilities and source code as input, the framework produced 15 working proof-of-concept exploits across both hypervisors.

The evaluation addressed three questions: (1) cross-domain gadgets are highly prevalent, with 772 instances across QEMU's device emulation codebase; (2) guest-to-host address translation functions produce pointers widely distributed across stack and heap memory; (3) the attack is effective against real vulnerabilities that were previously considered unexploitable.

The NVMe uninitialized free case study demonstrates the complete attack chain: vulnerability trigger, pointer redirection to guest space, fake chunk insertion into host free list, and escalation to traditional heap exploitation primitives.

Defensive Implications

▶ Watch: Case study: NVMe uninitialized free to use-after-free via guest memory (10:30)

The research has significant implications for cloud security posture:

Vulnerability triage needs updating: Many hypervisor pointer corruption vulnerabilities have been assessed as low-severity because they were considered unexploitable in practice. Cross-domain attacks demonstrate that any pointer corruption vulnerability in a hypervisor with guest memory mapping -- which is all of them -- should be treated as potentially exploitable.

Two mitigation directions are proposed: memory access control to restrict which host code paths can access guest-mapped memory, and gadget reduction to minimize the number of guest-to-host address translation sites in device emulation code. Both approaches target the cross-domain attack surface rather than individual vulnerabilities.

The fundamental problem is implicit trust: Hypervisors transparently treat guest-mapped memory as legitimate host memory when dereferenced through translated pointers. This implicit trust is the root cause that enables cross-domain attacks. Stronger isolation mechanisms that distinguish between host-native and guest-mapped memory would address the entire attack class.

For cloud providers, this research suggests that the set of exploitable hypervisor vulnerabilities is substantially larger than previously assessed, increasing the urgency of hypervisor patching and hardening programs.

Key Takeaways

• Guest VM memory mapped into host address space provides a reusable exploitation substrate, bypassing ASLR and host memory layout requirements
• 772 cross-domain gadgets found in QEMU across eight gadget families, distributed through all device emulation modules
• Automated framework converts non-exploitable pointer corruption vulnerabilities into working exploits
• 15 previously hard-to-exploit vulnerabilities in QEMU and VirtualBox successfully exploited
• Four attack variants: arbitrary code execution, information leakage, data overwriting, chunk confusion
• Cross-domain attacks exploit the implicit trust hypervisors place in guest-mapped memory during address translation
• Mitigations: memory access control on guest-mapped regions and reducing guest-to-host translation gadgets

About the Speaker(s)

The paper was presented by Gaoning Pan from CISPA on behalf of the original authors, who were unable to attend due to visa issues. The research team specializes in hypervisor security, vulnerability analysis, and automated exploitation techniques. Their work bridges static analysis, fuzzing, and exploit development to systematically assess hypervisor exploitability.