20 matches found
Januscape
Januscape: Guest-to-Host Escape in KVM/x86 Abstract This document describes the Januscape CVE-2026-53359 vulnerability discovered and reported by Hyunwoo Kim @v4bel. It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/x86 environment. To the best of public knowledge, th...
Zapscape
KVM エスケープ三部作 ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: KVM/x86 におけるゲストからホストへのエスケープ 概要 この文書は、Hyunwoo Kim @v4bel によって発見され、報告された Zapscape CVE-2026-64561 脆弱性について説明します。これは KVM/x86 環境において、ゲストがホストへエスケープし、カーネル root 権限でホスト上でコマンドを実行できるようにする KVM...
Januscape-Hotfix
Januscape 修正パッチコレクション — CVE-2026-53359 English KVM/x86 shadow MMU 仮想マシン脱出脆弱性（CVE-2026-53359）の完全な修正パッチコレクション 。 ダウンタイムゼロのホットフィックスからカーネルアップグレードまで、すべての運用シナリオをカバー。 ワンクリック診断 & 修正 root@kitploit: GitHub 直连 curl -sL https://raw.githubusercontent.com/Aoripus-LTD/Januscape-Hotfix/main/tools/januscape-fix.sh...
KVM-Januscape
KVM-XJ ホットパッチ dumptool.py はオフセットを自動検索するためのものです。使い方はコードを見てください。 脆弱性概要 CVE-2026-53359（Januscape）は、Linux カーネル KVM シャドウ MMU における Use-After-Free（UAF）脆弱性です。 潜伏期間：16 年（2010年8月～2026年7月） 影響範囲：ネステッド仮想化を有効にしたすべての Intel/AMD x86 システム 危険度：高、VM 内の root ユーザーがホストに脱出し、ホストの root 権限を取得可能...
CVE-2026-53359
🚨 CVE-2026-53359 — Januscape Linux KVM シャドウページング Use-After-Free（ゲストからホストへの脱出） Januscape は、x86 Shadow MMU における Use-After-Free UAF 状態によって引き起こされる Linux カーネル KVM の脆弱性です。脆弱な設定では、悪意のあるゲストがホストメモリを破損させ、ホストのクラッシュや VM 分離の破綻につながる可能性があります。 📌 概要 📖 説明 この脆弱性は、KVM のレガシーシャドウページング実装 に存在します。 以前のセキュリティ修正では Guest Fra...
CVE-2026-64561
CVE-2026-64561 — Zapscape:KVM/x86 shadow MMU UAF、guest から host root へのエスケープ HackSpeak 配布ミラー。本リポジトリは、研究者 Hyunwoo Kim@v4belが公開した完全な PoC + 技術ドキュメントの配布ミラーです 。コードとドキュメントはアップストリームと一致しています。 ⚠️ アップストリームには LICENSE が付属していません :本ミラーは配布の慣例に従い MIT License,Copyright c 2026 HackSpeak を採用しています。ソースコードの著作権は原作者 V4bel...
OESA-2026-3709 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root after making MMU pages available\n\nCheck for a "stale" page fault, i.e. for an invalid and/or obsolete root, after...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a “stale” page fault, i.e., an invalid and/or obsolete root. This occurs after making MMU pages available for the shadow MMU. If reclaiming shad...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102004)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102004 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for...
The vulnerability of the Shadow MMU management mechanism for page-level shadow tables in the KVM subsystem of the Linux operating system allows a perpetrator to escalate their privileges, execute arbitrary code, or cause service interruptions.
The vulnerability of the Shadow MMU management mechanism for virtual machine tables in Linux kernel-based virtual machines is related to the dereferencing of pointers with expired lifetimes. Exploiting this vulnerability can allow an attacker to enhance their privileges, execute arbitrary code, o...
Zapscape
The KVM Escape Trilogy ITScape CVE202646...
CVE-2026-64561
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages...
CVE-2026-64561
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages...
CVE-2026-64561 KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages...
CVE-2026-64561: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages...
SUSE CVE-2026-63807
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, before queryi...
CVE-2026-63807
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, before queryi...
CVE-2026-63807: Out-of-bounds Read
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, before queryi...
PT-2026-67668
Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.9 and earlier Description An issue exists in the KVM x86 component where the system fails to check for a stale page fault, specifically an invalid or obsolete root, after making MMU pages available for the shadow MMU. I...