Zapscape Is The Latest Linux Vulnerability For KVM Guest-To-Host Escape, LPE

Made public earlier today is Zapscape as a guest-to-host escape vulnerability affecting the Linux KVM x86 code for the past six years. This 2020 kernel change to KVM x86 can also be used as a local privilege escalation (LPE) exploit too where /dev/kvm is world-writable on some Linux distributions like RHEL.

Zapscape is a KVM escape vulnerability for KVM x86/x86_64 guests to escape to the host and run commands on the host as root. Zapscape revolves around a use-after-free vulnerability in the shadow MMU emulation code of the Kernel-based Virtual Machine in x86 code paths.

Along with today's announcement, fancy graphic for the vulnerability, and related information is also a public Proof of Concept (PoC) example albeit not in weaponized form.

Affected Linux kernel versions are from mid 2020 up through 21 July when this issue was fixed by checking for invalid/obsolete root after making MMU pages available.

KVM escape: With guest-side actions alone, an attacker can compromise the host that runs their VM. For example, an attacker who has rented just a single instance on a public cloud could panic the host kernel to take down every other tenant VM on the same physical machine (DoS), or run code with root privilege on the host to take over the host and all the guests on it (RCE).

LPE: On distributions such as RHEL, /dev/kvm is world-writable (0666), so an unprivileged user can also use this vulnerability as an LPE to gain root. When it is used as an LPE, host-side VMM ioctls are available, so the exploit becomes easier and more stable.

More details on Zapscape can be found via the Zapscape GitHub repository.