Zapscape Is The Latest Linux Vulnerability For KVM Guest-To-Host Escape, LPE
A new Linux vulnerability, Zapscape, has been discovered in the KVM x86 code, allowing guest-to-host escape and local privilege escalation (LPE) on certain Linux distributions.
Intelligence analysis by Llama
Zapscape is a use-after-free vulnerability in the shadow MMU emulation code of the Kernel-based Virtual Machine in x86 code paths, affecting Linux kernel versions from mid 2020 up through 21 July.
Imagine you're renting a virtual machine on a cloud server. A new vulnerability called Zapscape allows an attacker to escape the virtual machine and run commands on the host server as if they were the owner. This is like a 'backdoor' that lets the attacker do whatever they want on the host server.
Analysis
Zapscape Vulnerability Overview
Zapscape is a guest-to-host escape vulnerability affecting the Linux KVM x86 code for the past six years. This 2020 kernel change to KVM x86 can also be used as a local privilege escalation (LPE) exploit too where /dev/kvm is world-writable on some Linux distributions like RHEL.
Use-After-Free Vulnerability
Zapscape revolves around a use-after-free vulnerability in the shadow MMU emulation code of the Kernel-based Virtual Machine in x86 code paths. This vulnerability allows an attacker to escape the guest and run commands on the host as root.
Affected Linux Kernel Versions
Affected Linux kernel versions are from mid 2020 up through 21 July when this issue was fixed by checking for invalid/obsolete root after making MMU pages available.
KVM Escape and LPE
With guest-side actions alone, an attacker can compromise the host that runs their VM. For example, an attacker who has rented just a single instance on a public cloud could panic the host kernel to take down every other tenant VM on the same physical machine (DoS), or run code with root privilege on the host to take over the host and all the guests on it (RCE). On distributions such as RHEL, /dev/kvm is world-writable (0666), so an unprivileged user can also use this vulnerability as an LPE to gain root. When it is used as an LPE, host-side VMM ioctls are available, so the exploit becomes easier and more stable.
Further Reading
More details on Zapscape can be found via the Zapscape GitHub repository .
Key points
- Zapscape is a guest-to-host escape vulnerability affecting the Linux KVM x86 code.
- This vulnerability allows an attacker to escape the guest and run commands on the host as root.
- Affected Linux kernel versions are from mid 2020 up through 21 July.
- Zapscape can be used as a local privilege escalation (LPE) exploit on certain Linux distributions.
The discovery of Zapscape highlights the importance of ongoing security research and vulnerability disclosure. This vulnerability will likely be patched in future Linux kernel releases, and users can take steps to mitigate the risk by keeping their systems up-to-date and using secure configurations.
The Zapscape vulnerability has significant implications for cloud computing and virtualization, as an attacker can compromise the host that runs their VM, potentially leading to denial-of-service (DoS) or remote code execution (RCE). This vulnerability may be exploited by malicious actors to gain unauthorized access to sensitive data or systems.