SECURITY Signal 393
Zapscape Is The Latest Linux Vulnerability For KVM Guest-To-Host Escape, LPE
↗
Illustration only Photo by Ivan N on Unsplash
A vulnerability named Zapscape allows guest-to-host escape and local privilege escalation via Linux KVM x86 code, stemming from a kernel change made in 2020.
Engineers running KVM-based virtualization on x86 need to be aware of a six-year-old flaw that permits a malicious guest to compromise the host. Additionally, the vulnerability enables local privilege escalation on distributions where `/dev/kvm` is world-writable. Patching the kernel is the primary mitigation, though specific patch availability is not detailed in the provided material.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Zapscape is a guest-to-host escape vulnerability affecting Linux KVM x86 code.
The flaw originates from a kernel change made in 2020 and has been present for six years.
The vulnerability also functions as a local privilege escalation exploit where `/dev/kvm` is world-writable.
THE READ
What the cluster adds up to.
The disclosure of Zapscape highlights a security boundary failure in Linux KVM x86 virtualization. A guest operating system exploiting this flaw can potentially execute code on the host system, breaking the isolation guarantee that virtualization relies upon. This specific vulnerability has been present in the kernel for six years, originating from a change made in 2020. Beyond the guest-to-host escape, the vulnerability presents a secondary risk vector for local privilege escalation. On Linux distributions where `/dev/kvm` is configured as world-writable, a local user can leverage this flaw to escalate privileges. This means the impact is not limited to multi-tenant cloud environments but also affects systems with specific permission configurations. Mitigating this vulnerability will likely require updating the Linux kernel, although the provided material does not specify the exact patch versions or the cost of adoption. The local privilege escalation risk stops if `/dev/kvm` is not world-writable, but the guest-to-host escape risk remains for unpatched x86 KVM hosts. Engineers must verify their distribution's `/dev/kvm` permissions and monitor for kernel updates to fully addres
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER