Summary
A high-severity AML injection vulnerability in Contrast allows a malicious host to supply crafted ACPI bytecode that the guest kernel interprets. On affected AMD SEV-SNP configurations, this may enable code execution and disclosure or modification of confidential guest memory.
Affected context
The issue occurs in Contrast deployments using AMD SEV-SNP platforms where ACPI tables are supplied through the untrusted QEMU host and interpreted by the guest firmware and Linux kernel. It affects Metal-QEMU-SNP and Metal-QEMU-SNP-GPU configurations; Metal-QEMU-TDX is not affected because its ACPI table contents are measured into the TDX runtime measurement chain.
Exploit preconditions
- Attack surface: The virtual machine's ACPI table interface
- Required access: Control of, or the ability to influence, the untrusted host or QEMU process
- Trigger point: Guest firmware and Linux kernel processing of ACPI AML bytecode
- Why exploitation is possible: The guest AML interpreter executes host-provided, Turing-complete bytecode with access to guest memory, including confidential private pages
Why this happens
The vulnerability results from treating ACPI tables received from an untrusted host as executable AML without sufficiently isolating the interpreter from confidential guest memory. AML is a programmable bytecode language, so malicious table contents can cause the kernel interpreter to perform unintended operations. This maps to CWE-94: Improper Control of Generation of Code, because attacker-controlled input is interpreted as executable logic within a privileged guest component.
Potential impact
- Arbitrary code execution within the confidential guest
- Disclosure of private guest memory and confidential workloads
- Modification or corruption of guest data
- Compromise of services and workloads running inside the guest
- Undermining of confidentiality guarantees in affected deployment models
General mitigation guidance
Mitigation generally focuses on reducing trust in host-provided ACPI content and isolating AML interpretation from confidential memory.
Common defensive patterns include:
- Sandboxing the kernel AML interpreter so it cannot read or write private memory pages
- Restricting interpreter capabilities and validating ACPI structures before execution
- Preferencing confidential-computing designs that cryptographically measure relevant firmware and table contents
- Separating sensitive guest memory from interfaces that process untrusted host data
- Applying least privilege and minimizing guest kernel exposure to unnecessary ACPI functionality
- Monitoring platform configuration to ensure only supported, hardened confidential-computing modes are used
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis and code review of AML interpreter boundaries and memory-access paths
- Checks for guest kernel code that executes ACPI content supplied by virtual device or host interfaces
- Platform-policy validation confirming that sensitive ACPI inputs are measured or sandboxed
- Runtime monitoring for unexpected AML evaluation failures, abnormal ACPI table changes, or guest memory-access violations
- Security review tools and automated policy checks that flag executable parsing of untrusted firmware or virtualization inputs
