Hi Aaron and VirtualBox Developers,
I completely agree with this observation. The current guidance in Chapter
13 suggesting to disable nested paging for CVE-2018-3646 (Foreshadow /
L1TF) is significantly outdated for modern hardware and hypervisor
architectures.
In practice on modern Intel/AMD processors (such as Intel 10th/11th/12th+
Gen):
1. Modern CPU microcode and in-silicon designs already mitigate
L1TF/Foreshadow at the hardware level.
2. Disabling nested paging forces legacy software shadow paging, which
introduces substantial performance penalties, strips essential instruction
sets (AVX, AVX2, XSAVE, AES-NI), and creates severe stability issues (e.g.
Unrestricted Guest real-mode execution failures resulting in
VERR_INVALID_STATE / -79).
3. As noted, software shadow paging increases hypervisor attack surface and
has been deprecated in major hypervisors (such as Xen) due to DoS risks.
I have prepared a concise DocBook XML documentation patch for
'doc/manual/en_US/user_Security.xml' that modernizes this section and
advises keeping nested paging enabled on modern systems.
Proposed patch:
--- a/doc/manual/en_US/user_Security.xml
+++ b/doc/manual/en_US/user_Security.xml
@@ -428,20 +428,15 @@
<para>Mitigation options:</para>
<sect3>
- <title>Disable nested paging</title>
+ <title>Keep Nested Paging Enabled (Recommended for Modern Systems)</title>
- <para>By disabling nested paging (EPT), the VMM will construct page tables
- shadowing the ones in the guest. It is no longer possible for the guest
to insert
- anything fishy into the page tables, since the VMM carefully validates
each
- entry before shadowing it.</para>
-
- <para>As a side effect of disabling nested paging, several CPU features
- will not be made available to the guest. Among these features are AVX,
- AVX2, XSAVE, AESNI, and POPCNT. Not all guests may be able to cope with
- dropping these features after installation. Also, for some guests,
- especially in SMP configurations, there could be stability issues arising
- from disabling nested paging. Finally, some workloads may experience a
- performance degradation.</para>
+ <para>For modern processor architectures and current hypervisors, it is
+ strongly recommended to <emphasis>keep nested paging enabled</emphasis>
(EPT/NPT).
+ Modern CPUs include hardware-level microcode mitigations against
L1TF/Foreshadow.
+ Disabling nested paging forces legacy software shadow paging, which is
widely
+ deprecated, severely impacts guest performance, disables modern CPU
instruction sets
+ (such as AVX, AVX2, XSAVE, AES-NI), and significantly increases the
hypervisor's
+ software attack surface.</para>
</sect3>
<sect3>
Hopefully this helps update the official documentation to reflect current
security and virtualization practices.
Best regards,
Adrián
El jue, 27 ago 2026, 4:59, Aaron Rainbolt via vbox-dev <
[email protected]> escribió:
> Not sure this is the right place to post this, but since it's a
> possible error in the VirtualBox manual, I figured this was probably
> the closest-to-correct place.
>
> https://www.virtualbox.org/manual/ch13.html#sec-rec-cve-2018-3646
> currently suggests disabling nested paging for mitigating Foreshadow,
> stating that when nested paging is disabled, "[i]t is no longer
> possible for the guest to insert anything fishy into the page tables,
> since the VMM carefully validates each entry before shadowing it." From
> what I've heard from other virtualization security engineers though,
> nested paging is generally beneficial for security, and disabling
> nested paging increases attack surface. For instance, as of
> 2026-07-28, Xen has officially deprecated x86 shadow paging because of
> denial-of-service risks
> (https://xenbits.xenproject.org/xsa/advisory-495.html), and there have
> been lax checks in Xen's shadow paging implementation that could
> potentially have allowed a VM escape
> (https://xenbits.xen.org/xsa/advisory-430.html).
>
> Does Oracle simply trust its implementation of shadow paging more than
> it generally trusts CPUs to implement nested paging safely? Or is the
> advice to disable nested paging outdated and potentially more of a
> hazard than a hardening measure now? If the latter, the manual probably
> should be updated.
>
> --
> Aaron
> _______________________________________________
> vbox-dev mailing list
> [email protected]
> https://www.virtualbox.org/mailman/listinfo/vbox-dev
>
_______________________________________________
vbox-dev mailing list
[email protected]
https://www.virtualbox.org/mailman/listinfo/vbox-dev
