Đang tải bảng tin…
BleepingComputer0 Hot0 bình luận3 phút đọc
New Linux kernel flaw allows VM escape on Intel, AMD devices
A 16-year-old Linux kernel vulnerability called Januscape (CVE-2026-53359) enables guest-to-host virtual machine escape on both Intel and AMD architectures via a use-after-free bug in KVM/x86 shadow MMU emulation. Attackers with root inside a guest VM can execute arbitrary code as root on the host, take over all other tenant VMs, or crash the host kernel. It is the first known guest-to-host KVM exploit working across both CPU vendors, posing serious risk to multi-tenant public cloud environments. A patch (commit 81ccda30b4e8) was applied in June 2026. On distros like RHEL where /dev/kvm is world-writable, unprivileged users can also exploit it. A PoC triggering host kernel panic is public; a full escape exploit is withheld. The flaw can be chained with the previously disclosed Dirty Frag vulnerability for full compromise without guest root access.
Nguồn: https://www.bleepingcomputer.com/news/linux/new-januscape-linux-kernel-flaw-allows-vm-escape-on-intel-amd-devices. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.
Đề xuất cho bạn
All Things Open77 Hot3 phútAI
What is immutable Linux and should you switch to it?
Hệ điều hành Linux bất biến (Immutable Linux) phân phối OS dưới dạng image phiên bản có …
