Paulos Yibelo, the researcher who in early October claimed to have found a guest-host escape flaw in Linux KVM, the hypervisor used by most hyperscale clouds, has named the flaw PwnEscape and warned it might represent a new way to attack Linux – on top of being a 9.3-rated critical nasty in its own right. Yibelo’s work is now CVE-2026-99999. It is a scary bug because it makes a guest-host escape possible with a few malformed IPv4 packets. Such attacks are a nightmare security scenario because the whole point of virtualization is carving up hardware into isolated “guest” virtual machines that share a “host” server’s resources – without ever being able to see what other guests or the host are doing. Public clouds rely on that isolation remaining impervious. So do private clouds, because if guest/host isolation is violated, an attacker could conceivably access all the VMs on a host or pool of virtualized hardware. Attacks on a host could give an evildoer access to thousands of VMs, plus containers because many developers now run those constructs in a micro-VM to keep them isolated. PwnEscape makes it possible for guests to access the host, by sending a guest malformed IPv4 packets. As explained in a message from Red Hatter Michael S. Tsirkin in the Linux kernel stable tree, ‘If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief.” Analysis from threat-finding firm SOC Prime details the mischief. “Linux allows network packets to carry metadata indicating where a checksum operation should begin and where its result should be written. This optimization is legitimate and widely used for checksum offloading, but the security problem arises when less-trusted guest-controlled metadata can influence a write after the packet header has already passed earlier validation stages.” “Because the disclosure could be triggered repeatedly, an attacker controlling a guest workload could potentially collect information from a security domain that the virtual machine should not be able to inspect. This represents a direct failure of the guest-host isolation boundary.” Red Hat’s report says the impact can potentially include “arbitrary code execution on the host, a system crash resulting in Denial of Service, or information disclosure of sensitive memory.” A new class of threat Paulos Yibelo, the researcher who found the flaw, thinks he stumbled upon a novel attack. “As far as we know, PwnEscape exposes an entirely new class of attacks in Linux networking: untrusted checksum metadata can rewrite security-sensitive packet fields after the kernel has already validated and acted on them, undermining assumptions across the networking stack far beyond the original VM escape,” he wrote. “The popular mental model is that VM isolation lives in the virtual-machine monitor. Much of it does. But an attacker-controlled workload does not interact only with arch/x86/kvm/. It interacts with a host OS full of optimized, highly composable interfaces.” “If the metadata crosses a trust boundary, every deferred consumer has to inherit the right invariants. And if the packet can be transformed after those invariants are checked, the invariants have to remain true in the new representation.” “That is why a bug that looks, at first, like a malformed checksum hint can become a memory disclosure and a guest-to-host escape primitive. The problem was not how difficult IPv4 is to parse. It was that different parts of Linux were allowed to trust different versions of the same packet.” That’s an important observation, because while Linux KVM is widely used, and free, it is part of Linux – a project comprised of over 40 million lines of code. A vendor named Edera, which offers a secure container runtime based on the Xen hypervisor, last week none-too-gently pointed out that’s a big attack surface and that researchers have found seven escape bugs this year alone including Januscape. AWS, which runs its cloud on KVM, says its elastic compute cloud is not at risk. Google Cloud’s method of using KVM means it is probably in the clear, too. Developers have created an upstream fix in the Linux kernel. It’s percolating into major distros like Debian, RHEL, and Ubuntu and hopefully into virtualization products that rely on KVM, such as Nutanix and Proxmox. In the age of AI, miscreants will doubtless quickly explore Yibelo’s discoveries, making PwnScape potentially quite a moment for Linux developers and users. ®

VMware has discovered so many flaws in its products using AI that it felt the need to create a new product to help users manage them. Prashanth Shenoy, vice president of product marketing in the VMware Cloud Foundation (VCF) division of Broadcom, told The Register that VMware recently moved to deliver monthly software updates, in part to address bugs found by AI. He admitted, however, that users struggled to keep up with the pace of change before the move to monthly releases because it takes time to test the impact of patches – even though VCF allows non-disruptive live patching. Shenoy said customers therefore need "room to breathe." Enter a new tool called HyperArmor, which does three things. One is "virtual patching" – blocking attempts to exploit a vulnerability without changing the vulnerable software itself. VMware already offers virtual patching in its vDefend network security product and explains how it works by referring to CVE-2024-5806, the bug in file transfer tool MOVEIt that made waves in 2024. VMware says vDefend can detect patterns associated with attempts to exploit the authentication bypass flaw and block the traffic. HyperArmor will do similar things to block malicious traffic heading toward VCF implementations. Another job HyperArmor takes on is rejecting any actions that alter known good states in VCF. If a human approves a change, the tool will update policies to allow the altered state. The third job is multi-factor authentication (MFA). The Register put it to Shenoy that MFA is now table stakes for security. He agreed but explained that VMware designed HyperArmor to protect against attackers using stolen privileged credentials to access VMware's ESX hypervisor. To (hopefully) stop attackers using those creds to take over a host, HyperArmor requires users to input SSH credentials and a secondary time-based one-time password sent to a user with a verified identity. HyperArmor is a discrete product that VMware will sell as an add-on to VCF. That means VMware thinks its customers are going to be OK paying extra for MFA. While VMware will sell HyperArmor, it didn't create the product. Broadcom's security businesses Symantec and Carbon Black cooked it up. Broadcom's CA business (formerly Computer Associates) has done similar things. At VMware Explore on August 31, Broadcom launched AgentMinder, which aims to stop AI running inside VCF going rogue. AgentMinder came from CA but was launched as a tool for VCF (and third-party Kubernetes stacks). At VMware Explore, The Register met Ram Velaga, president of Broadcom's Infrastructure Software Group, and asked him if the group has a single strategy, or if its divisions each do their own thing. Velaga said Broadcom uses a combination of both approaches. "There's a level of focus with individual teams that you don't have if you have one very large central team," he said. "You get the speed at which you have to innovate with individual teams." Broadcom's Infrastructure Software Group therefore operates with at least six teams, and when one of those teams wants to add functions it will look for existing assets developed by another internal team rather than trying to write its own code. For broad products like VCF, the work of several Broadcom teams could therefore be relevant. The Register has no idea which team created the name HyperArmor, a question we pose as Cisco already offers a "Hypershield." Maybe this sort of name is what's needed to stop a HyperHoodie? ®