# CVE-2023-46813 PoC
1. Apply the patches in the `host-patches` folder to the Linux host and QEMU.
2. Start an SEV-SNP VM.
3. Run the code in this repo and wait for the message "waiting for the hypervisor to change memory to MMIO".
4. Spam the `attack` command in QEMU several times.
5. Once the exploit detects that the type of some of its memory has been changed to MMIO it will use the vulnerability to swap out its credentials with those of the init tasks.
Successful exploitation will look like this:
The exploit doesn't rely on any absolute kernel offsets but relies on the relative offsets of fields in the `struct task_struct` type. You might have to adjust those.
[4.0K] /data/pocs/0d69360643e8e430d217b02efd21f1922ed72cac
├── [2.2K] Cargo.lock
├── [ 242] Cargo.toml
├── [4.0K] host-patches
│ ├── [4.0K] linux
│ │ └── [3.8K] 0001-add-KVM_ATTACK-ioctl.patch
│ └── [4.0K] qemu
│ └── [4.3K] 0001-add-attack-command.patch
├── [ 699] README.md
├── [ 45K] screenshot.png
└── [4.0K] src
└── [ 13K] main.rs
4 directories, 7 files