القائمة
Virtual machine escape vulnerabilities — hypervisor exploitation, hardware virtualization bugs, device emulation attacks, side-channel attacks across VM boundaries
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Next-generation 0day discovery & exploit development — comprehensive code analysis, allocator vulnerabilities, compiler-induced bugs, SIMD/vector issues, JIT vulnerabilities, custom allocator attacks, ASLR/kASLR bypass, UAF, OOB, RCE with exploit generation, privilege escalation, backdoor establishment
Next-generation 0day discovery — novel overflow patterns, allocator exploits, compiler-induced bugs, bounds-check bypass, SIMD/vector overflows, JIT vulns, custom allocator attacks, ASLR/kASLR bypass, UAF, OOB, RCE with weaponized exploit generation, privilege escalation, backdoor establishment
Container escape vulnerability discovery — Docker, Kubernetes, container runtime exploitation, namespace isolation bypass, privilege escalation through container boundaries
Crypto implementation analysis — weak algorithms, side-channels, key management flaws, padding oracles, random generation failures, implementation bugs
IoT device security analysis — firmware extraction, RTOS exploits, hardware interfaces, protocol vulnerabilities, side-channel attacks, update mechanism exploitation
Industrial control system security — Modbus, DNP3, IEC 104, Ethernet/IP, PLC exploitation, control logic manipulation, sensor/actuator attacks, ICS protocol analysis
| name | VM Escape |
| description | Virtual machine escape vulnerabilities — hypervisor exploitation, hardware virtualization bugs, device emulation attacks, side-channel attacks across VM boundaries |
| tags | ["vm","escape","hypervisor","virtualization","hardware","qemu","vmware","hyper-v","xen","kvm","breakout","side-channel","vmm","guest-to-host"] |
| author | Spectra Security Research |
| version | 1 |
This skill analyzes virtual machine environments for escape vulnerabilities from guest VMs to the host system through hypervisor bugs, hardware virtualization issues, and device emulation flaws.
Permitted Contexts:
Prohibited:
Identify the virtualization platform:
# Check dmi/smbios for virtualization clues
dmidecode -s system-manufacturer 2>/dev/null
# Expected outputs:
# "QEMU", "Bochs", "VMware", "VirtualBox", "Xen", "KVM", "Microsoft", "Amazon EC2"
# Check CPUID for hypervisor presence
cpuid | grep -i hypervisor # If cpuid available
cat /proc/cpuinfo | grep -i hypervisor
# Check for hypervisor-specific files
ls -la /dev/virtio-*
ls -la /dev/vsock*
ls -la /sys/bus/virtio/
# Detect hypervisor type via devices
# VMware: /proc/vmware, /dev/vmmem
# VirtualBox: /dev/vboxguest, /dev/vboxuser
# KVM/QEMU: /dev/kvm, /dev/vhost-*
# Hyper-V: /dev/vmbus/
Hypervisor Signatures:
-virtio devices, /sys/devices/virtual/machine/qemu/VMware in dmi, vmware tools in /proc/vmware/VBox in dmi, /dev/vboxguestXen in dmi, /proc/xen/Microsoft HV in CPUIDAnalyze emulated devices for vulnerabilities:
# Check VirtIO device configurations
ls -la /sys/bus/virtio/devices/
cat /sys/bus/virtio/devices/*/name
# Check VirtIO versions
for dev in /sys/bus/virtio/devices/*/; do
echo "$dev"
cat "$dev/device/features" 2>/dev/null | xxd
done
# Check for vulnerable VirtIO implementations
# CVE-2019-14950: VirtIO table OOB
# CVE-2020-14364: Virtio-net buffer overflow
Vulnerable Patterns:
# Check network devices
lspci 2>/dev/null | grep -i network
ip link show
# Check for vulnerable network card emulation
# E1000: CVE-2015-5279 (QEMU)
# PCNet: CVE-2016-4454 (QEMU)
# RTL8139: CVE-2018-19307 (QEMU)
# NE2000: Multiple historical vulnerabilities
Novelty Indicators:
# Check storage controllers
lspci 2>/dev/null | grep -i storage
# Check for vulnerable storage controllers
# IDE: CVE-2020-14364 (QEMU AHCI)
# SCSI: CVE-2015-7504 (QEMU megasas)
# USB: CVE-2020-14372 (QEMU EHCI)
# Check Extended Page Tables (Intel VT-x)
# EPT poisoning allows host memory access from guest
# Detection: Check if EPT violations are logged
dmesg | grep -i ept
dmesl | grep -i "kvm.*ept"
# Check for nested virtualization
cat /proc/cpuinfo | grep -i "hypervisor\|vme"
lscpu | grep -i virtualization
EPT Violation Exploitation:
// Conceptual EPT violation exploit
// Requires: Vulnerable hypervisor, knowledge of EPT structure
// 1. Map guest physical page that points to host physical address
// 2. Trigger EPT violation with carefully crafted access
// 3. If hypervisor doesn't validate properly → host memory access
// Detection: Recent KVM/QEMU versions validate EPT more strictly
# Check memory dirty bitmap
# Dirty page tracking bugs can allow host memory disclosure
# Check KVM module version
modinfo kvm_intel | head -5 # Intel
modinfo kvm_amd | head -5 # AMD
# Check for CVE-2018-16871 (KVM mmu)
# Novelty: Look for recent dirty page handling changes
# - Recent Linux kernel KVM patches
# - Custom hypervisor implementations
# Check VMX capabilities
# VMCS is the Virtual Machine Control Structure
# Check CPUID for VMX support
cpuid | grep -i vmx
# Check /dev/kvm access
ls -la /dev/kvm
groups | grep kvm
# Look for VMX-related CVEs:
# CVE-2018-12991: VMCS shadowing
# CVE-2019-20933: Nested virtualization
VMX Exploitation:
# Check SVM capabilities
cpuid | grep -i svm
# Look for AMD-specific vulnerabilities:
# CVE-2021-29657: AMD SVC hypervisor interaction
# ARM virtualization extensions
# Check for VHE (Virtualization Host Extensions)
# On ARM guests:
cat /proc/cpuinfo | grep -i virtualization
# ARM-specific CVEs:
# CVE-2020-12351: ARM VPT (Virtual Page Table)
# CVE-2022-23960: ARM SVE (Scalable Vector Extension)
✓ Recent virtualization CVEs (2023-2024):
✓ Hypervisor-specific bugs:
✓ New device emulation:
✓ Side-channel research:
✗ Standard VMX/SVM exploits (well-documented) ✗ QEMU VirtIO buffer overflows (published CVEs) ✗ VMware Tools escape (known techniques) ✗ Hyper-V VMBus exploits (publicly disclosed)
| Escape Vector | Detection | Novelty |
|---|---|---|
| VMX/SVM bugs | cpuid | grep -i vmx|svm | Medium |
| VirtIO overflow | ls /sys/bus/virtio/ | Low (known) |
| EPT violation | dmesl | grep ept | Medium |
| Device emulation | lspci | grep -i net | High (if custom) |
| Nested virt | lscpu | grep Virtualization | Medium |
| Cache side-channel | Performance counters | High |
| Dirty page | modinfo kvm | Medium |
| Recent CVE | Hypervisor version | High |
| Custom hypervisor | Unusual dmi strings | Very High |