Xen SMEP & SMAP Bypass Technique Analysis

This 2015 technical blog explains how Xen's direct-mapped memory and the guest-exposed physical-to-machine (p2m) mapping can be abused to bypass SMEP and SMAP by computing DIRECTMAP_VIRT_START + MFN to obtain a ring0-only RWX virtual address that points to guest-controlled data, enabling hypervisor-level code execution from a compromised guest; the author demonstrates the technique, provides example code, discusses payload staging and data tunnelling, and suggests mitigations such as making the direct map non-executable or randomising hypervisor memory layout.