Linux KVM 是超大规模云服务商青睐的虚拟机监控程序，据称存在一个完整的虚拟机逃逸漏洞。这一糟糕的消息来自安全研究员 Paulos Yibelo，他在 X 平台上分享了一张漏洞赏金奖励的截图，称他发现了“完整的虚拟机逃逸零日漏洞（客户机到宿主机 root 权限，针对行业标准虚拟机监控程序）！”。
Linux KVM, the hypervisor favoured by hyperscale clouds, apparently has a full VM escape bug. That nasty news came from security researcher Paulos Yibelo, who on X shared a screenshot of a bug bounty award he won for discovering what he described as “Full VM escape zeroday (guest>host root in industry standard hypervisors)!”
Yibelo 参与的漏洞赏金计划由 Vercel 运营，该公司为 AI 智能体提供 MicroVM 作为沙箱运行环境。Vercel 的沙箱使用了 Firecracker MicroVM 技术，这是由 AWS 创建的技术，依赖于 Linux KVM —— Linux 内核级的虚拟机监控程序。Vercel CEO Guillermo Rauch 指出 KVM 就是 Yibelo 发现漏洞的虚拟机监控程序。
The bug bounty Yibelo participated in is run by Vercel, a company that provides MicroVMs as sandboxes for AI agents to work inside. The company’s Sandbox uses Firecracker MicroVMs, a technology created by AWS, which relies on Linux KVM – the kernel level hypervisor in Linux. Vercel CEO Guillermo Rauch named KVM as the hypervisor identified by Yibelo.
“我们通过 Vercel 沙箱赏金计划确认了一个 KVM 零日漏洞。影响 Linux 虚拟化领域的行业黄金标准解决方案，”他写道。目前公众视野中仅有这些信息。我们在相关邮件列表中找不到任何讨论。我们已向 Rauch 和 Yibelo 询问更多细节。
“We’ve confirmed a KVM 0day through our Vercel Sandbox bounty program. Affecting the industry’s gold standard solution for Linux virtualization,” he wrote. And that’s all the info that has made it into the public view at this time. The can find no chat on relevant mailing lists. We have asked Rauch and Yibelo for additional details.
希望未来几天或几周内我们都收不到他们的回复，原因有二。一是客户机-宿主机逃逸是虚拟化场景下的噩梦，因为这意味着运行客户机虚拟机的任何人都可能接管整台服务器，并可能获得控制其他客户机的能力。二是 KVM 令人惊讶地普及：AWS 和 Google 都用它来驱动其公有云。企业虚拟化厂商 Nutanix、HPE 和 Proxmox 也依赖 KVM。
Hopefully, we don’t hear from either of them for days or weeks, for two reasons. One is that guest-host escapes are the nightmare virtualization scenario because they mean whoever runs a guest VM could take over an entire server, and perhaps gain the ability to control other guests. The other is that KVM is astoundingly prevalent: AWS and Google both use it to power their public clouds. Enterprise virtualization players Nutanix, HPE, and Proxmox also rely on KVM.
当然，KVM 也在 Firecracker 中，后者是开源的，因此可能运行在各种地方。因此，Yibelo 发现的漏洞非常需要负责任的披露流程，因为如果关于该缺陷的线索泄露，可能会让攻击者造成大量破坏。一旦找到修复方案，下一个问题是实施修复是否会导致中断或停机。
And of course KVM is also in Firecracker, which is open source and could therefore be running in all sorts of places. Whatever Yibelo discovered therefore very much needs a responsible disclosure process, because if hints about the flaw emerge it could allow attackers to do a lot of damage. Once a fix is found, the next question is whether implementing it will require disruption or downtime.
可以对 KVM 进行热补丁修复，并将实时虚拟机从易受攻击的主机迁移到运行已修补版本 Linux 的机器上。希望这些技术能奏效。这可能是继所谓的“Januscape”漏洞后，今年在 KVM 中发现的第二个棘手漏洞。除了该漏洞造成的潜在风险外，观察人士认为，鉴于该缺陷的潜在严重性，Yibelo 的奖励应超过 Vercel 漏洞赏金计划提供的 50,000 美元。®
It’s possible to hot-patch KVM, and to migrate live VMs from vulnerable hosts to machines running a patched version of Linux. Hopefully those techniques will work. This might be the second nasty bug discovered in KVM this year, after the so-called Januscape flaw. Beyond the potential risks this bug created, observers have suggested the potential seriousness of the flaw means Yibelo’s reward should exceed the $50,000 available under Vercel’s bug bounty program. ®