Gleb Napatov found a bug in KVM that can be used to bypass proper IOPL/CPL
checking. KVM relies on CPU to check IOPL/CPL before instruction execution, so
emulator doesn't do IOPL/CPL checking. Malicious guest process running in SMP
guest can bypass CPU IOPL/CPL checking if it has access to IO port or MMIO
region. To do so it should run legitimate instruction that does IO and will
cause vcpu to enter emulator in one thread and replace this instruction to
malicious one from another thread. If instruction is replaced after KVM
entered emulator, but before instruction is fetched emulator will be
tricked to execute privileged instruction without permission checking.