CVE-2021-28476

CVE-2021-28476: Eine "Microsoft Hyper-V Remote Code Execution Vulnerability" von Gast zu Host in vmswitch.sys. Dies ist ein Proof of Concept für CVE-2021-28476 "Hyper-V Remote Code Execution Vulnerability", einen beliebigen Speicherlesevorgang in vmswitch.sys...

RWCTF21-VirtualBox-61-escape

RWCTF21-VirtualBox-61-escape 0day VirtualBox 6.1 Escape per RealWorld CTF 2020/2021 Demo Cosa? Questa è la nostra soluzione per la sfida "Box Escape" di RealWorld CTF dalle qualificazioni 2020/2021. Attualmente una 0day ma aggiungeremo il numero CVE appena ci sarà. CVE-2021-2119 Come funziona?...

Zapscape

La trilogia dell'escape KVM ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: Escape da guest a host in KVM/x86 Sommario Questo documento descrive la vulnerabilità Zapscape CVE-2026-64561 scoperta e segnalata da Hyunwoo Kim @v4bel. Si tratta di una...

Januscape-Hotfix

Raccolta di correzioni Januscape — CVE-2026-53359 English Raccolta completa di correzioni per la vulnerabilità di fuga dalla macchina virtuale KVM/x86 shadow MMU CVE-2026-53359. Dalla correzione a caldo con zero downtime all'aggiornamento del kernel, copre tutti gli scenari operativi. Diagnostica...

0vercl0k

0vercl0k PoC für CVE-2021-28476, eine „Hyper-V Remote Code Execution Vulnerability“ Gast-zu-Host-Schwachstelle in vmswitch.sys...

CVE-2021-28476

CVE-2021-28476: Dereferenziamento arbitrario di puntatore in Hyper-V vmswitch.sys da VM guest Riepilogo: Una macchina virtuale guest di Hyper-V può innescare una condizione di Denial-of-Service sul proprio host sottostante a causa di un parsing non sicuro dell'input da parte della funzione...

januscape

Januscape — Tracking-Website für den Linux-KVM/x86-Guest-to-Host-Escape Quellcode für den Januscape -Patch-Status-Tracker: eine einseitige Website, die verzeichnet, welche Distributionen einen Fix für den KVM/x86-Guest-to-Host-Escape im Linux-Kernel ausgeliefert haben. Wo die Fakten zu finden sin...

vbox_cve_2017_10235

CVE-2017-10235: Pufferüberlauf im VirtualBox E1000-Gerät Einleitung Das folgende Dokument beschreibt einen Fehler in VirtualBox v5.1.22 behoben in v5.1.24 in der Gastgeräte-Emulationskomponente DevE1000 Intel 82540EM Ethernet Controller Emulation, in der Funktion e1kFallbackAddToFrame, der zu ein...

itscape

ITScape — Sito di monitoraggio della fuga guest-to-host KVM/arm64 di Linux Sorgente del tracker dello stato delle patch ITScape : un sito a pagina singola che registra quali distribuzioni hanno distribuito una correzione per la fuga guest-to-host KVM/arm64 nel kernel Linux. Dove trovare i fatti...

ITScape

ITScape: Escape de Convidado para Host no KVM/arm64 Resumo Este documento descreve a vulnerabilidade ITScape CVE-2026-46316 , relatada e corrigida por Hyunwoo Kim @v4bel. Trata-se de uma vulnerabilidade de escape do KVM que permite que um convidado escape para o host em um ambiente KVM/arm64 e...

CVE-2026-53359

🚨 CVE-2026-53359 — Januscape Linux KVM Shadow Paging Use-After-Free Побег из гостевой в хостовую Januscape — это уязвимость ядра Linux KVM, вызванная состоянием Use-After-Free UAF в x86 Shadow MMU. При уязвимых конфигурациях вредоносная гостевая система может повредить память хоста, что приводит ...

Januscape

Januscape: Gast-zu-Host-Ausbruch in KVM/x86 Zusammenfassung Dieses Dokument beschreibt die Januscape CVE-2026-53359 -Sicherheitslücke, entdeckt und gemeldet von Hyunwoo Kim @v4bel. Es handelt sich um eine KVM-Escape-Sicherheitslücke, die es einem Gast ermöglicht, in einer KVM/x86-Umgebung zum Hos...

CVE-2026-53360-POC

CVE-2026-53360: heap out-of-bounds in PSC di KVM SEV-SNP Proof of concept per una lettura e scrittura heap out-of-bounds nella gestione del Page State Change PSC di KVM SEV-SNP. Un guest SEV-SNP malevolo fa sì che il kernel host percorra un array di voci PSC oltre la fine della sua allocazione...

CVE-2026-53078 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-qemu-melange, linux-gcp...

CVE-2026-47243 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

buffer overruns in libfsimage iso9660 handling

ISSUE DESCRIPTION The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: The directory loop itself assumes a good record length. This is CVE-2026-42494. The calculation of the System...

kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM x86 shadow paging mechanism. This vulnerability occurs when a host page directory entry PDE mapping is changed from within the guest, leading to an unexpected role mismatch in shadow paging. This mismatch can cause a...

Exploit for CVE-2026-53359

Januscape Hotfix — CVE-2026-53359 简体中文 Ze...

16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems

A use-after-free bug in Linux's KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host kernel that runs it. Dubbed 'Januscape' and tracked as CVE-2026-53359, the flaw sits in the shadow MMU code that KVM shares across both Intel and AMD. The publ...

EUVD-2026-32356

In the Linux kernel, the following vulnerability has been resolved: xen-netback: reject zero-queue configuration from guest A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect function in the backend only validates the upper bound requestednumqueue...