Hunting and Exploiting Recursive MMIO Flaws in QEMU KVM

This talk analyzes recursive MMIO flaws in QEMU/KVM, where DMA to a device's own MMIO region can re-enter a handler and damage device state or crash the hypervisor. It examines the flaws' root causes, consequences, and exploitability.