Red Hat Openstack Platform 13 Queens
Monthly
Privileged users inside a guest running on a Q35/KVM QEMU virtual machine can abuse the VAPIC setup hypercall in hw/i386/vapic.c to position a writable RAM alias over locked SMRAM, bypassing the Q35 chipset's D_LCK protection and injecting code into System Management Mode memory - the highest-privilege execution context on the platform. The flaw is an out-of-bounds write (CWE-787) scored 6.7 under CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H: it is local to the guest, requires an already root-equivalent account there, and does not affect non-Q35 machine types or non-KVM configurations, which substantially narrows realistic exposure. No public exploit code was identified at time of analysis and there is no confirmed active exploitation, but the SMM-level payoff makes it attractive as the final step in a guest-to-firmware escalation chain.
Privileged users inside a guest running on a Q35/KVM QEMU virtual machine can abuse the VAPIC setup hypercall in hw/i386/vapic.c to position a writable RAM alias over locked SMRAM, bypassing the Q35 chipset's D_LCK protection and injecting code into System Management Mode memory - the highest-privilege execution context on the platform. The flaw is an out-of-bounds write (CWE-787) scored 6.7 under CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H: it is local to the guest, requires an already root-equivalent account there, and does not affect non-Q35 machine types or non-KVM configurations, which substantially narrows realistic exposure. No public exploit code was identified at time of analysis and there is no confirmed active exploitation, but the SMM-level payoff makes it attractive as the final step in a guest-to-firmware escalation chain.