11 matches found
matchlock
Matchlock 実験段階: このプロジェクトは現在活発に開発中であり、破壊的変更が行われる可能性があります。 Matchlock は、一時的なマイクロVM内でAIエージェントを実行するためのCLIツールです。ネットワークの許可リスト、MITMプロキシによるシークレットインジェクション、VMレベルの分離を備えています。シークレットがVMに入ることはありません。 なぜMatchlockか？ AIエージェントはコードを実行する必要がありますが、無制限にマシンへのアクセスを与えることはリスクです。Matchlock...
CVE-2026-53359
🚨 CVE-2026-53359 — Januscape Linux KVM シャドウページング Use-After-Free（ゲストからホストへの脱出） Januscape は、x86 Shadow MMU における Use-After-Free UAF 状態によって引き起こされる Linux カーネル KVM の脆弱性です。脆弱な設定では、悪意のあるゲストがホストメモリを破損させ、ホストのクラッシュや VM 分離の破綻につながる可能性があります。 📌 概要 フィールド| 値 ---|--- CVE| CVE-2026-53359 ニックネーム| Januscape コンポーネント|...
CVE-2026-89932 KVM: nVMX: Always flush vpid02 on first use
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first use by setting lastvpid=0 when allocating vpid02. nestedvmxtransitiontlbflush will always detect a VPID change on first VM-Enter after VMXON,...
CVE-2026-45102
OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability is fixed in 10.0.98...
CVE-2026-45102
OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability is fixed in 10.0.98...
OneUptime 安全漏洞
OneUptime is a comprehensive solution developed by OneUptime OpenSource. It is used to monitor and manage your online services. Versions of OneUptime prior to 10.0.98 contained security vulnerabilities. These vulnerabilities stemmed from the use of the Node.js vm module as an isolation primitive,...
Improper Isolation or Compartmentalization
Overview Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in the mounting of host directories in read-only mode into VM. An attacker can gain unauthorized write access to the host filesystem by remounting a shared directory as read-write from within t...
Incomplete List of Disallowed Inputs
Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the isVMLowLevelOptionForbidden function in lxd/project/limits/permissions.go. An attacker can set forbidden low-level VM configuration keys, such as raw.apparmor or raw.qemu.conf in a project th...
USN-7940-1: Linux kernel (Azure FIPS) vulnerabilities
Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...
USN-7939-2 linux-azure-fips vulnerabilities
Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...
