In the hypervisor provided in OpenBSD identified , allowing manipulation on the guest system side to achieve overwriting of the host environment's kernel memory areas. The issue is caused by the fact that part of the guest system's physical addresses (GPA, Guest Physical Address) is reflected in the kernel's virtual address space (KVA), but write protection is not applied to KVA areas marked as read-only for GPA. Due to the lack of necessary checks in the function evmm_update_pvclock(), it is possible to pass host system KVA addresses to the pmap call and overwrite the kernel memory.
Addendum: The OpenBSD developers released to fix the vulnerability.
Source: opennet.ru
