Critical PwnEscape Linux Kernel Flaw Allows VM Guest Memory Leak
A critical flaw in the Linux kernel allows code running inside a virtual machine guest to read memory from the host system.
FTMQ Security, written by our newsroom4 views
A critical security flaw known as PwnEscape in the Linux kernel allows code inside a virtual machine to read memory on the host computer. CyberSecurityNews, Cyber Kendra, and The Hacker News all report that the flaw allows guest virtual machines to compromise host security. The Hacker News and Cyber Kendra note that the issue lets guest virtual machines read host memory and break out to interact with the host system. [1][2][5]
According to The Hacker News, a security researcher demonstrated the memory leak against live cloud sandboxes belonging to Vercel. Vercel confirmed the issue after the researcher showed that code inside a guest environment could read memory from the host machine. [2]
The Linux kernel is a free and open source operating system kernel created by Linus Torvalds in 1991. A virtual machine escape occurs when a program breaks out of an isolated guest operating system to interact directly with the host operating system. [6][7]
In short
- The PwnEscape Linux kernel flaw allows code inside a guest virtual machine to read host memory.
- A researcher demonstrated the memory leak against Vercel's live cloud sandboxes.
- Vercel confirmed the security issue following the demonstration.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Critical Linux Kernel Flaw Lets Attackers Escape Virtual Machines and Take Control of HostsCyberSecurityNews, 1d ago (the report this story comes from)
- [2]Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host MemoryThe Hacker News, 1d ago
- [3]Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed ModulesThe Hacker News, 1d ago
- [4]Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit AttemptsThe Hacker News, 1d ago
- [5]PwnEscape Linux Kernel Flaw Lets Guests Escape to HostCyber Kendra, 1d ago
Background
- [6]Linux kernel on Wikipedia
- [7]Virtual machine escape on Wikipedia
Our newsroom writes these reports with the help of software, from the 7 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Proof of concept exploit released for critical VMware VMXNET3 security flawBugs and Patches, 8d ago
More in Top Stories
- OpenAI skill repository contains hallucinated domain vulnerability affecting Render app tokens5h ago
- Researchers publish local privilege escalation exploit targeting OpenBSD 7.95h ago
- Critical BlockStrap flaw threatens Magento and Adobe Commerce servers5h ago
- Hackers exploit BeyondTrust zero day vulnerability to hijack remote servers5h ago
- Hackers exploit Collabora CODE flaw to deploy Nextcloud backdoors1d ago
- Cisco Patches Zero Day Flaw in Secure Email Gateway2d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.