Vulnerabilities(?) in OpenBSD's hypervisor.

Three things are wrong:

1) The RO protections are not enforced, so the guest could have data be written to a GPA it can only access as RO.

2) If 'pvclock_ti' crosses a page, its second half could point to an HPA that doesn't belong to the guest. The guest can therefore, to some limited extent, overwrite host kernel memory.

3) The pmap is not locked, so if the GPA gets unmapped and its corresponding HPA recycled, there is a small window where the (new) content of the HPA can get overwritten.

https://marc.info/?l=openbsd-tech&m=158176939604512&w=2

#security