In their demonstration, the researchers managed to change the header length from 20 to 60 bytes, while the packet buffer held only 28 bytes of valid data. The fragmentation process then copied 32 bytes beyond that valid data into outgoing packets, leaking host memory. By repeating the process, the researchers were able to make observations and control memory allocations to achieve host-kernel memory writes to run a helper program as root. The complete exploitation steps that take this attack from a memory leak to code execution have not been publicly revealed yet, but the researchers plan a separate write-up.
“The allocator-sensitive write chain, object-lifetime controls, and other hypervisor-specific adaptation are large enough to require a separate article,” they said. “Although we suspect the security industry will use this post to figure out the other affected hypervisors and we expect exploits in weaker configurations to arrive in weeks, and exploits working in default hypervisor configurations to arrive in under a month.”
The attack surface extends beyond KVM
PwnEscape differs from other VM escape attacks that target the hypervisor’s handling of virtual CPUs or memory. The Januscape vulnerability disclosed earlier this year, for example, affected KVM’s memory-management code, but with this exploit the vulnerable code is in the Linux host’s IPv4 networking subsystem.
The researchers warn that similar bugs could exist elsewhere in the networking stack, wherever guest-controlled metadata can modify packet fields after those fields have already passed validation.
The accepted patch, authored by Red Hat developer Michael S. Tsirkin, adds validation at five checksum completion points, including IPv4 fragmentation, bridge connection tracking, and packet filtering, but the patch commit message states that “a more complete validation at input is forthcoming, but needs more work.”
