ITScape

ITScape: KVM/arm64 中的虚拟机逃逸到宿主机 摘要 本文档描述了由 Hyunwoo Kim @v4bel 报告并修复的 ITScape CVE-2026-46316 漏洞。这是一个 KVM 逃逸漏洞，允许虚拟机在 KVM/arm64 环境中逃逸到宿主机，并以内核（root）权限在宿主机上执行命令。据公开所知，这是首个针对 KVM/arm64 的虚拟机逃逸到宿主机的利用研究。 ITScape 利用的是 KVM/arm64 的 vGIC-ITS（中断翻译服务） 模拟中的竞态条件。它仅通过客户机侧的操作触发该漏洞，从而逃逸到宿主机，并且可能威胁到接受非受信任客户机的...

Januscape

Januscape: KVM/x86의 게스트-호스트 탈출 개요 이 문서는 Hyunwoo Kim @v4bel이 발견하고 보고한 Januscape CVE-2026-53359 취약점에 대해 설명합니다. 이는 KVM/x86 환경에서 게스트가 호스트로 탈출할 수 있게 하는 KVM 탈출 취약점입니다. 공개된 정보에 따르면, 이는 단일 아키텍처에 국한되지 않고 Intel과 AMD 모두에서 트리거 가능한 최초의 게스트-호스트 익스플로잇 연구입니다. Januscape는 KVM/x86의 섀도 MMU 에뮬레이션에서 발생하는 use-after-fre...

Zapscape

KVM エスケープ三部作 ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: KVM/x86 におけるゲストからホストへのエスケープ 概要 この文書は、Hyunwoo Kim @v4bel によって発見され、報告された Zapscape CVE-2026-64561 脆弱性について説明します。これは KVM/x86 環境において、ゲストがホストへエスケープし、カーネル root 権限でホスト上でコマンドを実行できるようにする KVM...

Januscape-Hotfix

Januscape 수정 패치 모음 — CVE-2026-53359 English KVM/x86 shadow MMU 가상 머신 이스케이프 취약점CVE-2026-53359에 대한 완전한 수정 패치 모음 입니다. 제로 다운타임 핫픽스부터 커널 업그레이드까지 모든 운영 시나리오를 다룹니다. 원클릭 진단 및 수정 root@kitploit: GitHub 직통 curl -sL https://raw.githubusercontent.com/Aoripus-LTD/Januscape-Hotfix/main/tools/januscape-fix.sh |...

RWCTF21-VirtualBox-61-escape

RWCTF21-VirtualBox-61-escape RealWorld CTF 2020/2021을 위한 0day VirtualBox 6.1 탈출 데모 무엇? 이것은 RealWorld CTF 2020/2021 예선의 'Box Escape' 챌린지에 대한 우리의 솔루션입니다. 현재는 0day이지만 CVE 번호가 나오면 추가하겠습니다. CVE-2021-2119 어떻게 동작하나요? 취약점과 익스플로잇 기술을 설명하는 블로그 포스트를 작성했습니다. 여기에서 찾을 수 있습니다. 어떻게 보호하나요? VirtualBox의 릴리스 빌드가 패치될...

januscape

Januscape — Linux KVM/x86 ゲストからホストへのエスケープ追跡サイト Januscape パッチステータストラッカーのソース: Linux カーネルにおける KVM/x86 のゲストからホストへのエスケープに対する修正を、どのディストリビューションがリリースしたかを記録する単一ページのサイトです。 正確な情報の所在 このバグに関するすべて — CVE ID、影響を受けるバージョンと修正済みバージョン、上流の修正コミット、発見・開示のクレジット、および現時点のディストリビューション別パッチステータス — は、この README ではなくトラッカーページに属します:...

CVE-2026-53359

🚨 CVE-2026-53359 — Januscape Linux KVM 섀도우 페이징 Use-After-Free 게스트-투-호스트 탈출 Januscape 는 x86 섀도우 MMU 의 Use-After-FreeUAF 조건으로 인해 발생하는 Linux Kernel KVM 취약점입니다. 취약한 구성에서 악의적인 게스트가 호스트 메모리를 손상시켜 호스트 충돌을 유발하고 잠재적으로 VM 격리를 깨뜨릴 수 있습니다. 📌 개요 📖 설명 이 취약점은 KVM의 레거시 섀도우 페이징 구현 에 존재합니다. 이전 보안 패치는 게스트 프레임 번호GFN...

itscape

ITScape — Linux KVM/arm64 ゲストからホストへのエスケープ追跡サイト ITScape パッチステータストラッカーのソースです。Linux カーネルの KVM/arm64 ゲストからホストへのエスケープに対する修正を、どのディストリビューションがリリースしたかを記録するシングルページサイトです。 事実はどこにあるか バグに関するすべての情報（CVE ID、影響を受けるバージョンと修正済みバージョン、上流の修正コミット、発見と開示のクレジット、ディストリビューションごとの最終的なパッチステータス）は、この README ではなくトラッカーページにあります。 表示:...

CVE-2026-47243 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

EUVD-2020-27254

Malware in sbrugna...

CVE-2020-6100

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. A specially crafted pixel shader can cause memory corruption vulnerability. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2023-4155

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in KVM AMD Secure Encrypted Virtualization SEV in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a doubl...

kernel: KVM: SEV-ES / SEV-SNP VMGEXIT double fetch vulnerability

A flaw was found in KVM AMD Secure Encrypted Virtualization SEV in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the VMGEXIT handler recursively. If an attacker manages to call the handler multiple time...

Race condition

A flaw was found in KVM AMD Secure Encrypted Virtualization SEV in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the VMGEXIT handler recursively. If an attacker manages to call the handler multiple time...

CVE-2023-4155 Sev-es / sev-snp vmgexit double fetch vulnerability

A flaw was found in KVM AMD Secure Encrypted Virtualization SEV in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the VMGEXIT handler recursively. If an attacker manages to call the handler multiple time...

CVE-2023-4155

CVE-2023-4155 describes a vulnerability in the Linux kernel’s KVM AMD SEV implementation. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race that causes the VMGEXIT handler to be invoked recursively. If the handler is called multiple times, this can lead to a ...

CVE-2023-4155

A flaw was found in KVM AMD Secure Encrypted Virtualization SEV in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the VMGEXIT handler recursively. If an attacker manages to call the handler multiple time...

Fedora 37 : kernel (2023-d9509be489)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d9509be489 advisory. The 6.4.10 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly...

NVIDIA D3D10 Driver Shader Functionality dcl_input index memory corruption vulnerability

Talos Vulnerability Report TALOS-2023-1720 NVIDIA D3D10 Driver Shader Functionality dclinput index memory corruption vulnerability August 10, 2023 CVE Number CVE-2022-34671 SUMMARY A memory corruption vulnerability exists in the Shader Functionality of NVIDIA D3D10 Driver NVIDIA D3D10 Driver,...

CVE-2023-4155

A flaw was found in KVM AMD Secure Encrypted Virtualization SEV in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the VMGEXIT handler recursively. If an attacker manages to call the handler multiple time...