[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-92309":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":8,"htmlUrl":8,"language":9,"languages":8,"totalLinesOfCode":8,"stars":10,"forks":11,"watchers":12,"openIssues":13,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":14,"stars7d":14,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":14,"compositeScore":16,"rankGlobal":8,"rankLanguage":8,"license":8,"archived":17,"fork":17,"defaultBranch":18,"hasWiki":17,"hasPages":17,"topics":19,"createdAt":8,"pushedAt":8,"updatedAt":20,"readmeContent":21,"aiSummary":22,"trendingCount":14,"starSnapshotCount":14,"syncStatus":23,"lastSyncTime":24,"discoverSource":25},92309,"Januscape","V4bel\u002FJanuscape","V4bel",null,"C",474,62,3,4,0,264,49.4,false,"main",[],"2026-07-22 04:02:05","# Januscape: Guest-to-Host Escape in KVM\u002Fx86\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"assets\u002Ftux.png\" width=\"400\" alt=\"tux\">\n\u003C\u002Fp>\n\n# Abstract\n\n![demo](assets\u002Fdemo.gif)\n\nThis document describes the **Januscape (CVE-2026-53359)** vulnerability discovered and reported by [Hyunwoo Kim (@v4bel)](https:\u002F\u002Fx.com\u002Fv4bel). It is a KVM escape vulnerability that lets a guest escape to the host in a KVM\u002Fx86 environment. To the best of public knowledge, this is the first guest-to-host exploit research triggerable on both Intel and AMD rather than being limited to a single architecture.\n\nJanuscape is a use-after-free vulnerability in the **shadow MMU** emulation of KVM\u002Fx86. It can trigger the bug with guest-side actions alone to corrupt the host kernel's shadow page, and it can threaten the guest-host isolation of KVM\u002Fx86 hosts that accept untrusted guests and expose nested virtualization, particularly multi-tenant x86 public clouds (GCP, AWS, etc.).\n\nIn fact, Januscape was successfully used as a 0-day exploit in [Google kvmCTF](https:\u002F\u002Fsecurity.googleblog.com\u002F2024\u002F06\u002Fvirtual-escape-real-reward-introducing.html).\n\nFor the detailed technical information, [see here](assets\u002Fwrite-up.md).\n\n> [!NOTE]\n> After reporting this vulnerability to linux-distros@vs.openwall.org, the agreed embargo has ended, so the exploit is posted to oss-security and this Januscape document is published. For the disclosure timeline, see the technical detail document.\n\n# PoC Structure\n\nRunning the PoC inside a guest VM can trigger a host kernel panic. A full escape exploit that works in a controlled environment also exists, but it is not released at this time and is planned to be released in the very distant future.\n\nOn distributions like RHEL, `\u002Fdev\u002Fkvm` is world-writable (`0666`), so an unprivileged user could also turn this vulnerability into a reliable LPE to root. That said, doing so would be like paying gold for garbage, so I won't bother covering it.\n\n# PoC Usage\n\n1. Inside the guest VM, install the headers and build the module.\n```\n# sudo apt-get install -y build-essential linux-headers-$(uname -r)\n# make\n```\n\n2. Load the module inside the guest. KVM holds the raw VMX\u002FSVM state, so unload it first. Load with no argument on Intel, and with amd=1 on AMD.\n```\n[Intel]\n# sudo rmmod kvm_intel; sudo insmod poc.ko\n\n[AMD]\n# sudo rmmod kvm_amd; sudo insmod poc.ko amd=1\n```\n\n3. The race starts, and within seconds to minutes the host KVM panics.\n```\n[*] poc step 4\u002F4: race live -- host DoS triggering\n...\nkernel BUG at arch\u002Fx86\u002Fkvm\u002Fmmu\u002Fmmu.c (pte_list_remove)\nComm: qemu-kvm\n```\n\nThis PoC is intended to provide accurate information. Do not use it on systems you are not authorized to test.\n\n# Affected Versions\n\nJanuscape (CVE-2026-53359) covers the range from [2032a93d66fa (2010-08-01)](https:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Ftorvalds\u002Flinux.git\u002Fcommit\u002F?id=2032a93d66fa) to [81ccda30b4e8 (2026-06-16)](https:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Ftorvalds\u002Flinux.git\u002Fcommit\u002F?id=81ccda30b4e8).\n\nIn other words, this vulnerability lay dormant for about \"16 years\".\n\n# FAQ\n\n## What is the impact of this vulnerability?\n\nThere are two impacts in total:\n\n1. **KVM escape**: With guest-side actions alone, an attacker can compromise the host that runs their VM. For example, an attacker who has rented just a single instance on a public cloud could panic the host kernel to take down every other tenant VM on the same physical machine (DoS), or run code with root privilege on the host to take over the host and all the guests on it (RCE).\n2. **LPE**: On distributions such as RHEL, `\u002Fdev\u002Fkvm` is world-writable (`0666`), so an unprivileged user can also use this vulnerability as a reliable LPE to gain root.\n\n## Should I be worried?\n\nIf you operate an x86 KVM host that accepts multi-tenant guests and supports nested virtualization, or use an instance on top of one, check that the 81ccda30b4e8 patch is applied to the host kernel.\n\n## Are arm64-based KVM hosts also vulnerable?\n\nNo. The vulnerability is triggered only on the Intel and AMD architectures. That said, if you have not yet patched the previously published [ITScape (CVE-2026-46316)](https:\u002F\u002Fgithub.com\u002FV4bel\u002FITScape), your arm64 hosts are also vulnerable, so apply the patch promptly.\n\n## Does this vulnerability occur in QEMU?\n\nNo. Unlike the commonly published QEMU escape vulnerabilities, Januscape occurs in in-kernel KVM, so it is triggered independently of QEMU's emulation. Because of this, it can also threaten large public clouds that implement and use their own virtualization stack.\n\n## Do I need root inside the guest VM?\n\nYes. Inserting the module requires guest kernel privilege. When you are allocated an instance on a public cloud, you usually have root on your own VM, so this is satisfied. In a scenario without guest root, it must be chained with an LPE such as [Dirty Frag](https:\u002F\u002Fgithub.com\u002FV4bel\u002Fdirtyfrag).\n","Januscape 是一个针对 KVM\u002Fx86 虚拟化平台的来宾到宿主机逃逸漏洞（CVE-2026-53359），利用 shadow MMU 中的 use-after-free 缺陷实现跨虚拟机边界的权限提升。其核心特点是支持 Intel 和 AMD 双架构，仅需来宾侧操作即可触发宿主机内核崩溃或完成逃逸，无需宿主机交互。项目包含可复现的 PoC 模块，已在 Google kvmCTF 等实战场景中验证有效性。适用于云安全研究、虚拟化漏洞分析及多租户公有云（如 AWS、GCP）环境下的隔离性评估，但仅限授权测试使用。",2,"2026-07-08 04:30:04","CREATED_QUERY"]