Toward Hardening VirtIO Drivers for Confidential VMs with a Rust-based DSL

Abstract

This work proposes a framework for hardening VirtIO drivers in confidential virtual machines (CVMs) against malicious host inputs. Although CVMs protect guest workloads from an untrusted hypervisor, VirtIO drivers must still process data supplied by the host, exposing them to vulnerabilities such as buffer overflows and time-of-check-to-time-of-use (TOCTOU) attacks. The proposed framework abstracts VirtIO operations into typed Rust interfaces and uses a domain-specific language (DSL) to describe packet layouts and constraints, enabling automatic validation of untrusted inputs and safer implementation of VirtIO drivers.

Reference

Lianjie Wang and Takahiro Shinagawa. Toward Hardening VirtIO Drivers for Confidential VMs with a Rust-based DSL. In 17th ACM SIGOPS Asia-Pacific Workshop on Systems, Sep, 2026. .