Story thread · 2 reports / 2 sources

Zapscape Is The Latest Linux Vulnerability For KVM Guest-To-Host Escape, LPE

phoronix.com · 4dShare

Made public earlier today is Zapscape as a guest-to-host escape vulnerability affecting the Linux KVM x86 code for the past six years. This 2020 kernel change to KVM x86 can also be used as a local privilege escalation (LPE) exploit too where /dev/kvm is world-writable on some Linux distributions like RHEL...

First report: New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts — thehackernews.com, 5d