Listen to this Post
The vulnerability, known as BadAML, exploits the ACPI interface in confidential VM setups. ACPI tables contain AML bytecode, which the host (QEMU) passes to the guest firmware (OVMF) and then to the Linux kernel. The kernel’s AML interpreter executes this bytecode, and AML is Turing‑complete with access to the entire guest memory, including private pages. An attacker with host control can inject a maliciously crafted ACPI table containing arbitrary AML code. When the guest kernel interprets it, the attacker achieves arbitrary code execution inside the confidential VM. This attack is not specific to a single product but affects confidential computing environments that rely on ACPI without adequate isolation. The issue was first publicly detailed in 2024. The root cause is that the AML interpreter lacks sandboxing, allowing injected code to read or write private memory pages that should remain protected from the host. The attack model assumes the host is compromised, which is standard for confidential computing threat models. Mitigation requires restricting the interpreter’s memory access. A page‑table lookup on each AML read/write can deny access to private pages while still allowing shared pages. This sandbox approach has been implemented in the Linux kernel used by Contrast. Without such restrictions, any AML injection becomes a full guest compromise.
Platform: AMD SNP / QEMU
Version: Affected SNP platforms
Vulnerability: AML injection
Severity: Critical
Date: 2024 (published)
Prediction: Patch already available
What Undercode Say:
Check if AML interpreter has page-table restrictions dmesg | grep -i "aml.sandbox" grep -i "acpi.enforce" /boot/config-$(uname -r) Verify if ACPI tables are measured (TDX vs SNP) cat /sys/kernel/security/tpm0/ascii_runtime_measurements | grep -i "acpi"
Exploit:
Attacker crafts malicious ACPI table with AML code, injects it via host (QEMU), guest kernel executes AML, accesses private memory, and achieves arbitrary code execution inside confidential VM.
Protection from this CVE:
Apply patched Linux kernel that implements AML sandbox with page-table lookups to block private memory access. For affected platforms (Metal-QEMU-SNP, Metal-QEMU-SNP-GPU), upgrade to fixed Contrast version immediately.
Impact:
Full arbitrary code execution inside the confidential guest, compromising confidentiality and integrity of protected workloads despite host isolation assumptions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
