Key facts
- A critical Linux vulnerability named Januscape has been discovered.
- The vulnerability allows virtual machines to escape and gain root access to host machines.
- Januscape resides in KVM's shadow MMU emulation.
- The flaw was discovered by Hyunwoo Kim.
- The vulnerability has existed in the Linux kernel for 16 years.
A critical vulnerability within Linux's Kernel-based Virtual Machine (KVM) has been identified, allowing virtual machines to escape their isolated environments and achieve root access on the host system. Dubbed Januscape, the flaw was discovered by researcher Hyunwoo Kim. The vulnerability lies within KVM's shadow MMU emulation, a component responsible for managing memory access for virtual machines. This particular flaw has a long history, having been present in the Linux kernel for approximately 16 years. The potential impact of Januscape is significant, as it could permit untrusted virtual machines to compromise the security and integrity of the underlying host operating system. This could lead to unauthorized access, data breaches, or further malicious activity on the host machine.