Critical PwnEscape Linux Kernel Flaw Allows VMs to Read Host Memory

Summary: A newly discovered critical vulnerability in the Linux kernel allows code within virtual machines to read the memory of the host computer they run on. A researcher demonstrated this flaw against Vercel’s live cloud sandboxes, and Vercel confirmed it.

A critical security vulnerability, dubbed “PwnEscape,” has been discovered in the Linux kernel. This flaw allows unprivileged code within a virtual machine (VM) to access and read the memory of the host system it runs on. This is a very serious vulnerability that fundamentally violates the isolation model in virtualization environments.

Technically, such a vulnerability typically stems from a memory management error in the kernel or a flaw in the virtualization layer (hypervisor or related modules). Memory leakage from a VM to the host can occur via a side-channel attack or direct memory addressing manipulation. This situation could lead to the exposure of sensitive data (passwords, keys, etc.) on the host system.

The impact of this vulnerability on live systems and cloud infrastructures is immense. Especially in multi-tenant cloud environments, it poses a risk of accessing data from one customer’s VM to other customers’ or the cloud provider’s host system. Its confirmation in Vercel’s sandbox environments demonstrates the reality of this risk. Urgent kernel patches and system updates are essential.

Infrastructure engineers must immediately check the Linux kernel versions used in virtualization platforms and apply available patches. Furthermore, it should be ensured that isolation between virtual machines is strengthened not only by software but also by hardware support (such as Intel VT-x, AMD-V), and that these features are correctly configured.

🔗 Source: The Hacker News
📡 Authoritative feeds & live tracking: Radar