Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
litebox-snp-novalidation-userptr — High local write primitive: LiteBox v0.1.0 SNP UserPtr is NoValidation so guest syscall buf can be a kernel VA | Kitploit
Tools/GitHubGitHub/abraxas/litebox-snp-novalidation-userptr
Privilege EscalationMemory ForensicsVulnerability AnalysisExploitationSecurity VirtualizationCloud SecurityHardware SecurityPapers & ResearchBinary Exploitation

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
GitHubabraxas/litebox-snp-novalidation-userptr

litebox-snp-novalidation-userptr

High local write primitive: LiteBox v0.1.0 SNP UserPtr is NoValidation so guest syscall buf can be a kernel VA

View Repository
74 days agoNot yet reviewed

Abraxas Labs - litebox-snp-novalidation-userptr

abraxaslabs.tech  ·  github.com/abraxas  ·  @abraxas_null  ·  [email protected]  ·  litebox-snp-novalidation-userptr

litebox-snp-novalidation-userptr

Class: Write primitive (guest-to-SNP-kernel R/W) Reach: Local

LiteBox v0.1.0 (d8556e3) - Microsoft

SNP LinuxKernel wires UserConstPtr / UserMutPtr to NoValidation, which returns the pointer unchanged. The comment is TODO: implement pointer validation to ensure the pointers are in user space. LVBS already range-checks USER_ADDR_MIN..USER_ADDR_END (0x10000 .. 0x7ffffffff000 on x86_64) and wraps copies in STAC/CLAC. SNP does not. Guest mmap of a kernel VA is rejected (TASK_ADDR_MAX), so CPL3 stores cannot hit the kernel heap. The syscall path runs in kernel mode and can. memcpy_fallible is rep movsb in supervisor mode.

This leftover is guest-to-SNP-kernel (VMPL2 LiteBox) R/W. It is not host VMPL0, not hypervisor, and not SNP firmware.

IDno CVE yet
ClassWrite primitive (guest-to-SNP-kernel R/W)
ReachLocal (untrusted guest userspace inside litebox_runner_snp)
CWECWE-823, CWE-119
CVSSHigh: 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productmicrosoft/litebox
Affectedv0.1.0 (d8556e33676e47244bfefa139c1e9ff95bd67d53) SNP kernel platform. TODO still on origin/main as of 97001fd
Authguest already running inside the SNP VM
LicenseGNU Affero GPL v3.0
Lab127.0.0.1 only. No SNP hardware

What an attacker can do

Who: untrusted guest userspace inside litebox_runner_snp. Issue #505 (open RFC) is this class. LVBS implemented it. SNP did not.

Integrity (lab-proven gadget)

The lab is a supervisor-mode copy_from_slice gadget of the two validators plus a copy of pin litebox_platform_linux_kernel/src/lib.rs. It is not a guest syscall on SNP hardware.

PathDest VAResult
SNP NoValidation (identity)0x1000 (below USER_ADDR_MIN) and 0xffff800000000000 (GVA_OFFSET)accept; memcpy writes LITEBOX-SNP-NOVALIDATION-USERPTR-WITNESS into the kernel-labeled object
LVBS range checksame kernel destsreject, errno=14 EFAULT, kernel object empty
Bothlegal user dest 0x400000both copy the witness into the user object
Pin file in the imagen/aTODO comment plus UserConstPtr / UserMutPtr wired to NoValidation (LvbsValidateAccess absent)

Integrity (inferred from the pin syscall path)

Method + sinkPrivilege
read / readv / pread / recv* / getcwd / uname / epoll_pwait with buf = kernel VA -> UserMutPtr::copy_from_slice -> memcpy_fallible (rep movsb)write up to MAX_KERNEL_BUF_SIZE (512 KiB) per syscall, or iovec page chunks, into any mapped SNP kernel VA. Payload is guest-chosen (pipe/file the guest wrote)

Recon (inferred)

Method + sinkPrivilege
write / writev / send* with buf = kernel VA -> read_at_offsetread mapped SNP kernel memory into a guest fd
unmapped kernel VAEFAULT via the exception table (mapper of which kernel pages exist)

Availability (inferred)

Method + sinkPrivilege
corrupt SNP kernel heap / page tables / shim TLScrash or divert the SNP guest kernel. I do not claim a reliable RIP gadget

What this leftover does not grant

  • Host VMPL0, hypervisor, SNP firmware
  • LVBS VTL1 (LvbsValidateAccess + STAC/CLAC)
  • sysretq to a kernel RIP (sanitize_for_user_return refuses non-user RIP/RSP)
  • Guest mmap / mprotect of kernel VA (TASK_ADDR_MAX)
  • Linux/Windows userland NoValidation (same process; host boundary there is seccomp, that is a sibling leftover)
  • Not a break of SEV-SNP C-bit confidentiality by itself. It is a confused-deputy copy inside the LiteBox SNP kernel

How I found it

litebox_platform_linux_kernel/src/lib.rs lines 59-67 on v0.1.0. The TODO is still on main. LVBS already has LvbsValidateAccess with USER_ADDR_MIN = 0x10000 and USER_ADDR_MAX = 0x7ffffffff000. I did not have SNP hardware. The lab copies the pin file, implements identity vs range check, and writes the witness through NoValidation into dest VAs the LVBS check rejects.

Lab

cd lab
./run.sh

Loopback 127.0.0.1:19130. Compose project litebox-snp-novalidation-userptr. Witness LITEBOX-SNP-NOVALIDATION-USERPTR-WITNESS. Last line:

SUCCESS litebox-snp-novalidation-userptr novalidation-kernel-write-ok lvbs-range-reject pin-TODO-present user-range-copy-ok LITEBOX-SNP-NOVALIDATION-USERPTR-WITNESS

Fix

Wire SNP UserPtr to the same userspace range check LVBS already has (USER_ADDR_MIN..USER_ADDR_END), and keep copies behind the exception table. Do not leave NoValidation on a kernel platform.

Vendor intake is MSRC (https://msrc.microsoft.com/create-report). Do not open a public GitHub issue on microsoft/litebox.

Contact

Abraxas Labs - abraxaslabs.tech - github.com/abraxas - @abraxas_null - [email protected]

Download Tool