hyperv_local_dos_poc

Hyper-V 拒绝服务概念验证。 这是 Visual Studio 2019 驱动程序项目的代码文件。 1. 编译驱动程序。 2. 使用以下命令为客户操作系统启用嵌套虚拟化： root@kitploit: Set-VMProcessor -VMName -ExposeVirtualizationExtensions $true 3. 在客户操作系统内运行驱动程序。主机操作系统将重启或生成带有 HYPERVISORERROR 代码的蓝屏死机。 该漏洞存在于 Hyper-V 中，影响 Windows Server 2019、安装了最新补丁的 Windows 10 以及 Windows 10...

Zapscape

La trilogía de escapes de KVM ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: Escape de invitado a host en KVM/x86 Resumen Este documento describe la vulnerabilidad Zapscape CVE-2026-64561 , descubierta e informada por Hyunwoo Kim @v4bel. Es una...

Januscape

Januscape：KVM/x86 环境中的客户机到宿主机逃逸 摘要 本文档描述了由 Hyunwoo Kim @v4bel 发现并报告的 Januscape CVE-2026-53359 漏洞。这是一个 KVM 逃逸漏洞，可使客户机在 KVM/x86 环境中逃逸至宿主机。据公开所知，这是首个可在 Intel 和 AMD 上触发而不仅限于单一架构的客户机到宿主机利用研究。 Januscape 是 KVM/x86 的 shadow MMU 模拟中的一个释放后使用漏洞。仅通过客户机侧操作即可触发该漏洞，破坏宿主机内核的影子页，并可能威胁那些接受不可信客户机并暴露嵌套虚拟化的 KVM/x86...

CVE-2026-64561

CVE-2026-64561 — Zapscape: KVM/x86 shadow MMU UAF, escape del guest al host root HackSpeak 分发镜像。本仓库为研究员 Hyunwoo Kim@v4bel公开的完整 PoC + 技术文档的分发镜像 ,代码与文档与上游一致。 ⚠️ 上游未附 LICENSE :镜像按分发惯例采用 MIT License,Copyright c 2026 HackSpeak ,源码版权归原代码作者 V4bel / @v4bel。PoC 未经真机验证 ,请先在可销毁环境QEMU TCG测试,勿对未授权目标使用。 Resumen...

kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM nSVM module. When a nested virtual machine L2 guest executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor L1, KVM incorrectly uses vmcb02 instead of vmcb01 for managing guest state...

CVE-2021-3656-Demo

CVE-2021-3656： 此问题是由于缺少对 virtext VMCB 字段的验证，允许恶意的 L1 客户机为 L2 客户机关闭 VMLOAD/VMSAVE 拦截和 VLS（虚拟 VMLOAD/VMSAVE）。在此情况下，L2 客户机能够不受拦截地运行 VMLOAD/VMSAVE，从而读取/写入主机物理内存的部分内容。 设置环境以访问 Linux 内核： 1. 你可以使用 Docker 容器或虚拟机。我将尽量使用 Docker 容器完成。 2. 你需要在 Mac 或 Windows 上安装 Docker Desktop。如果你默认使用 Linux 机器，可以忽略所有这些步骤。 3...

KVM-Januscape

KVM-XJ Hot Patch dumptool.py automatically finds offsets; how to use it? Just read the code. Vulnerability Overview CVE-2026-53359 Januscape is a use-after-free UAF vulnerability in the Linux kernel KVM shadow MMU. Lurking time : 16 years August 2010 to July 2026 Affected range : All Intel/AMD x8...

CVE-2026-80873

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESREL2 for injected nested SError exceptions kvminjectel2exception writes ESREL2 for synchronous exceptions but not for SError. enterexception64 does not write ESRELx for any exception type, so the construct...

PT-2026-85792

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESR EL2 for injected nested SError exceptions kvm inject el2 exception writes ESR EL2 for synchronous exceptions but not for SError. enter exception64 does not write ESR ELx for any exception type, so the...

The vulnerability of the kvm_vcpu_init_nested() function in the arch/arm64/kvm/nested.c module of the virtualization subsystem on the 64-bit ARM-based Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the kvmvcpuinitnested function in the arch/arm64/kvm/nested.c module of the virtualization subsystem on the 64-bit ARM-based Linux operating system is related to the copying of buffers without checking input data. Exploiting this vulnerability could allow an attacker to...

CVE-2026-80699

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component for ARM64 architectures. This vulnerability, specifically affecting AmpereOne processors, occurs when a physical interrupt is double-deactivated in a nested virtualization context. An attacker could potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-80665

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns...

SUSE CVE-2026-80699

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested state, the physical interrupt has already been deactivated through the HW bit in the LR. The extra deactivation would be harmless but can hit a...

CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-80699

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested state, the physical interrupt has already been deactivated through the HW bit in the LR. The extra deactivation would be harmless but can hit a...

UBUNTU-CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-80665

This vulnerability affects the Linux kernel's KVM arm64 nested virtualization subsystem. The root cause is in kvm_handle_vncr_abort() , which incorrectly assumes that a -EFAULT return from kvm_translate_vncr() always conveys an abort. In practice, "late" failures on S1 translation output (e.g., a...

EUVD-2026-67541

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...