Zapscape Is The Latest Linux Vulnerability For KVM Guest-To-Host Escape, LPE
Curated from Phoronix
If you manage virtualized infrastructure, this disclosure demands immediate attention rather than casual reading. Zapscape represents a critical failure in the isolation boundary between guest VMs and the host kernel, a trust model that underpins nearly all modern cloud and on-premise deployments. The fact that this vulnerability has persisted since a 2020 kernel change highlights the complexity of maintaining secure hypervisor code over time. For SREs, the risk extends beyond simple isolation breaches; the potential for local privilege escalation via /dev/kvm access creates a direct path from a compromised container or VM to root-level control of the physical host. This is not a theoretical edge case but a practical attack vector that bypasses traditional security controls. You must verify your kernel versions and patch management pipelines immediately. The concrete takeaway is to audit your /dev/kvm permissions across all RHEL and similar distributions today, ensuring access is strictly restricted to authorized services, not world-writable.
Made public earlier today is Zapscape as a guest-to-host escape vulnerability affecting the Linux KVM x86 code for the past six years. This 2020 kernel change to KVM x86 can also be used as a local privilege escalation (LPE) exploit too where /dev/kvm is world-writable on some Linux distributions like RHEL...
— Phoronix