Virtual Server Isolation Boundary Breached... High-Risk Linux KVM Vulnerability Disclosed
IT DAILY ·
✦ AI Summary
The identifier for PwnEscape, a high-risk vulnerability discovered in the Linux kernel, is CVE-2026-99999.
The vulnerability can be exploited in KVM environments and is known to bypass the VM isolation boundary and allow access to physical servers.
AWS posted a security notice and recommended updates and reboots for affected versions.
A high-risk vulnerability discovered in the Linux kernel has been disclosed as exploitable in KVM environments. According to reports from overseas media outlets including The Hacker News on the 16th, the security research team PWN.AI disclosed details of the target vulnerability, PwnEscape. The identifier for this vulnerability is CVE-2026-99999.
PwnEscape is known as a vulnerability that can bypass the isolation boundary between virtual servers. If exploited, it is reported to allow access to physical servers. The full name of KVM is Kernel-based Virtual Machine.
KVM is a function that supports running multiple VMs on a single physical server. On KVM-based systems, Linux operating system virtualization is used. KVM is used in cloud services and data centers.
In connection with this, AWS posted a security notice. AWS urged users operating virtualization environments to apply updates.
A VM, a virtual machine, is based on the premise that a failure in one VM will not affect another VM or the host server, in accordance with the principle of mutual isolation. However, if this vulnerability is exploited, attackers can break through the VM isolation boundary and access the actual server. The vulnerability occurs during the process of sending and receiving network data between the VM and the server.
The attack condition is to secure elevated privileges inside the VM and then send a special network packet. In that case, the attack could affect the Linux kernel memory of the server running the VM. The kernel manages core functions of the operating system.
AWS explained that, in relation to this vulnerability, part of server memory could be leaked by an attacker. AWS also said that server malfunction could be triggered. The cause was identified as insufficient information validation while the Linux kernel processes network data.
The PWN.AI researchers succeeded in reading server memory in a KVM test environment they built themselves. The PWN.AI researchers also succeeded in making limited changes to kernel memory. They then reached code execution with the server's highest administrator privileges. This demonstrates the possibility that an intruder inside a virtual server could expand to the server itself.
Although the risk posed by PwnEscape is significant, the vulnerability is described as not being at a level that would allow an external attacker to take over a server immediately. To exploit it, elevated privileges must first be secured inside the virtual server, and no signs of real-world abuse have been confirmed yet.
The affected environment is one using Linux kernel 4.4 through 6.18 without the patch applied. In addition, the system must use KVM, use 'virtio-net,' and operate VMs directly.
AWS said environments that directly manage VM execution technologies such as Firecracker may also be affected. On the other hand, Amazon EC2, AWS Lambda, and AWS Fargate, which are AWS-managed services, are not affected.
Regarding the response, AWS distributed an Amazon Linux 2 patched kernel update and an Amazon Linux 2023 patched kernel update. There is no workaround, and users running affected versions must apply the update. A system reboot is also required after the update.
Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242251
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.