Vercel has confirmed a zero-day vulnerability in Linux KVM that security researcher Paulos Yibelo described as allowing a full virtual machine escape, CEO Guillermo Rauch said.. Yibelo said on X that the flaw could allow a user inside a guest virtual machine to gain root access on its host.
He shared a screenshot showing a bug-bounty award for the discovery, which he described as “Full VM escape zeroday (guest>host root in industry standard hypervisors)!”. “We’ve confirmed a KVM 0day through our Vercel Sandbox bounty program. Affecting the industry’s gold standard solution for Linux virtualization,” Rauch wrote, identifying KVM as the hypervisor affected by Yibelo’s discovery..
No further technical details about the vulnerability have been publicly disclosed. The Register said it found no discussion on relevant mailing lists and had asked both Rauch and Yibelo for additional information.. A guest-to-host escape could allow someone controlling a guest virtual machine to take over the server hosting it.
That access could potentially extend to control over other guest virtual machines running on the same server.. KVM is widely used in cloud and enterprise virtualization. AWS and Google use it to power their public clouds, while Nutanix, HPE and Proxmox also rely on the technology..
Vercel runs the bounty program through which Yibelo reported the flaw. Its Sandbox product provides MicroVM-based environments in which AI agents can operate.. Sandbox uses Firecracker MicroVMs, a technology created by AWS that relies on KVM, the kernel-level hypervisor in Linux.
Firecracker is open source, so KVM-based deployments could also exist in environments beyond the named cloud and enterprise providers.. The flaw requires responsible disclosure because partial details or hints about how it works could enable attackers to exploit it. The absence of public technical information leaves the precise conditions needed for an escape undisclosed..
Once a fix is developed, a remaining question will be whether deploying it requires service disruption or downtime. KVM can potentially be hot-patched, and live virtual machines can be migrated from vulnerable hosts to machines running a patched version of Linux. Whether those methods will work for this flaw remains unresolved..
The discovery may be the second serious KVM vulnerability identified this year, following the flaw known as Januscape.. Observers have suggested that the potential severity of Yibelo’s discovery warrants a reward exceeding the $50,000 available under Vercel’s bug-bounty program.
The amount he received was not disclosed in the publicly described details.. Featured image credit. Tags: Linux KVMvercelzero-day
