Critical MMU Bounds Bypass: How a Missing Validation Exposes Host Memory

Introduction

When you run a virtual machine or an emulator, you place enormous trust in one foundational promise: the guest cannot see the host. The code running inside the sandbox should have no visibility into the memory of the process hosting it. This isolation is not just a feature — it is the entire security model.

A recently patched critical vulnerability in a RISC-V emulator shattered that promise. The mmu_ifetch function in src/system.c performed virtual-to-physical address translation for guest programs but failed to validate whether the resulting physical address actually fell within the emulator's allocated memory region. A crafted guest program could exploit this gap to read arbitrary chunks of the host process's memory — potentially exposing cryptographic keys, authentication tokens, passwords, or any other sensitive data resident in the host process at the time.

This post breaks down how the vulnerability worked, what the fix looks like, and what every developer working near memory management or virtualization code should take away from it.

The Vulnerability Explained

What Is MMU Address Translation?

Modern processors — including RISC-V — use a Memory Management Unit (MMU) to provide virtual memory. Guest programs don't work directly with physical RAM addresses; instead, they use virtual addresses that the MMU translates to physical ones via page tables. In an emulator, this translation happens in software: the emulator intercepts the guest's virtual address, walks the emulated page tables, and produces a physical address, which it then maps to a real offset into a host-allocated memory buffer.

The critical step — the one that was missing — is confirming that the translated physical address is actually within bounds of that host buffer before using it.

The Vulnerable Code Path

The vulnerable function, mmu_ifetch (MMU instruction fetch), is responsible for fetching the next instruction from a translated guest address. The flow looks roughly like this:

// Simplified illustration of the vulnerable pattern
uint32_t mmu_ifetch(cpu_state *cpu, uint64_t vaddr) {
    uint64_t paddr = mmu_translate(cpu, vaddr, ACCESS_EXECUTE);
    // ❌ No bounds check here — paddr is used directly
    return memory_ifetch(paddr);
}

The mmu_translate function returns a physical address, but nothing verifies that this address falls within [0, emulator_memory_size). The subsequent call to memory_ifetch uses that address as an offset into the host's memory buffer.

How Could It Be Exploited?

An attacker who controls a guest program — for example, in a scenario where untrusted code is executed inside the emulator — can craft a sequence of memory mappings or exploit quirks in the page-table walking logic to produce a translated physical address that is outside the emulator's allocated region.

When memory_ifetch then dereferences this out-of-bounds address, it reads from wherever that offset points in the host process's address space. Depending on memory layout, this could be:

• Stack data from the host process (local variables, return addresses, canary values)
• Heap allocations containing decrypted secrets, session tokens, or private keys
• Mapped shared libraries or other sensitive segments
• Anything else the host process has mapped into its virtual address space

A Concrete Attack Scenario

Imagine a developer tool or sandbox that uses this emulator to run untrusted RISC-V binaries for testing or analysis. An attacker submits a specially crafted binary. That binary manipulates its own page tables (or exploits a quirk in how the emulator handles certain page-table entries) to make mmu_translate return a physical address like 0xFFFFFFFF00000000 — far beyond the emulator's 256 MB memory buffer.

The emulator happily fetches an "instruction" from that location. What it actually reads is host memory — perhaps the contents of an OpenSSL context sitting on the heap, or a recently-decrypted private key. The guest binary can then exfiltrate this data through any available side channel (timing, output, network, etc.).

This is not theoretical. Variants of this class of bug have been found in production hypervisors and emulators, including QEMU, VirtualBox, and others, and have been assigned CVEs with high or critical severity ratings.

The Fix

What Changed

The fix was applied in src/io.c (the memory access layer), adding the bounds validation that should have always been present. The corrected logic ensures that any physical address produced by MMU translation is checked against the valid range of emulator-allocated memory before it is dereferenced.

The corrected pattern looks like this:

// BEFORE (vulnerable)
uint32_t mmu_ifetch(cpu_state *cpu, uint64_t vaddr) {
    uint64_t paddr = mmu_translate(cpu, vaddr, ACCESS_EXECUTE);
    return memory_ifetch(paddr);  // ❌ No bounds check
}

// AFTER (fixed)
uint32_t mmu_ifetch(cpu_state *cpu, uint64_t vaddr) {
    uint64_t paddr = mmu_translate(cpu, vaddr, ACCESS_EXECUTE);

    // ✅ Validate physical address is within allocated memory region
    if (paddr >= cpu->mem_base && (paddr - cpu->mem_base) < cpu->mem_size) {
        return memory_ifetch(paddr - cpu->mem_base);
    }

    // Raise a guest-level fault instead of reading out-of-bounds
    cpu_raise_exception(cpu, EXCEPTION_INSTRUCTION_ACCESS_FAULT, vaddr);
    return 0;
}

Why This Fix Works

The key insight is fail-closed behavior: instead of attempting the memory access and hoping the address is valid, the code now explicitly checks the address against the known-valid range first. If the address falls outside that range, a guest-level exception is raised — which is the architecturally correct response to an invalid memory access in RISC-V — and no host memory is touched.

This approach has several important properties:

1. No information leakage: Out-of-bounds addresses never reach the host memory access functions.
2. Correct guest semantics: The guest program receives a proper access fault exception, just as real hardware would deliver.
3. Defense in depth: Even if mmu_translate has other bugs that produce unexpected addresses, the bounds check provides a safety net.

Conclusion

The mmu_ifetch bounds-check vulnerability is a textbook example of how a single missing validation in a trusted, low-level component can collapse an entire security boundary. Emulators and hypervisors are held to an exceptionally high standard precisely because they are the last line of defense between untrusted guest code and the host environment. When that boundary fails, the consequences can be severe: credential theft, key exfiltration, privilege escalation, or worse.

The fix is simple in retrospect — check the address, raise a fault if it's invalid — but the lesson is broader: never assume that a computed value is safe just because it came from your own code. Translation functions, parsers, and calculators can all produce unexpected results, especially when their inputs are attacker-controlled. Validate at the boundary, fail closed, and use tooling like sanitizers and fuzzers to catch what human reviewers miss.

Secure code is not about being clever. It is about being consistently careful, especially in the places where the stakes are highest.

This vulnerability was identified and patched as part of an automated security review process. For more information on securing emulation and virtualization code, consult the OWASP Testing Guide and the CWE/SANS Top 25 Most Dangerous Software Weaknesses.