vm-escape

name	VM Escape
description	Virtual machine escape vulnerabilities — hypervisor exploitation, hardware virtualization bugs, device emulation attacks, side-channel attacks across VM boundaries
tags	["vm","escape","hypervisor","virtualization","hardware","qemu","vmware","hyper-v","xen","kvm","breakout","side-channel","vmm","guest-to-host"]
author	Spectra Security Research
version	1

VM Escape Analysis

Overview

This skill analyzes virtual machine environments for escape vulnerabilities from guest VMs to the host system through hypervisor bugs, hardware virtualization issues, and device emulation flaws.

---

⚠️ Authorized Use Only

Permitted Contexts:

• Authorized penetration testing with explicit scope
• CTF competitions (e.g., CONFidence CTF, DEFCON)
• Security research in isolated VM environments
• Educational hypervisor analysis

Prohibited:

• Unauthorized VM escape attempts
• Production hypervisor testing without permission
• Cloud provider escape without explicit authorization

---

Analysis Phases

Phase 1: Hypervisor Identification

Identify the virtualization platform:

# Check dmi/smbios for virtualization clues
dmidecode -s system-manufacturer 2>/dev/null
# Expected outputs:
# "QEMU", "Bochs", "VMware", "VirtualBox", "Xen", "KVM", "Microsoft", "Amazon EC2"

# Check CPUID for hypervisor presence
cpuid | grep -i hypervisor  # If cpuid available
cat /proc/cpuinfo | grep -i hypervisor

# Check for hypervisor-specific files
ls -la /dev/virtio-*
ls -la /dev/vsock*
ls -la /sys/bus/virtio/

# Detect hypervisor type via devices
# VMware: /proc/vmware, /dev/vmmem
# VirtualBox: /dev/vboxguest, /dev/vboxuser
# KVM/QEMU: /dev/kvm, /dev/vhost-*
# Hyper-V: /dev/vmbus/

Hypervisor Signatures:

• QEMU/KVM: -virtio devices, /sys/devices/virtual/machine/qemu/
• VMware: VMware in dmi, vmware tools in /proc/vmware/
• VirtualBox: VBox in dmi, /dev/vboxguest
• Xen: Xen in dmi, /proc/xen/
• Hyper-V: Microsoft HV in CPUID

---

Phase 2: Device Emulation Analysis

Analyze emulated devices for vulnerabilities:

2.1 VirtIO Devices

# Check VirtIO device configurations
ls -la /sys/bus/virtio/devices/
cat /sys/bus/virtio/devices/*/name

# Check VirtIO versions
for dev in /sys/bus/virtio/devices/*/; do
    echo "$dev"
    cat "$dev/device/features" 2>/dev/null | xxd
done

# Check for vulnerable VirtIO implementations
# CVE-2019-14950: VirtIO table OOB
# CVE-2020-14364: Virtio-net buffer overflow

Vulnerable Patterns:

• Legacy VirtIO implementations without proper bounds checking
• Missing validation in virtqueue processing
• Unchecked buffer accesses in device emulation

2.2 Network Card Emulation

# Check network devices
lspci 2>/dev/null | grep -i network
ip link show

# Check for vulnerable network card emulation
# E1000: CVE-2015-5279 (QEMU)
# PCNet: CVE-2016-4454 (QEMU)
# RTL8139: CVE-2018-19307 (QEMU)
# NE2000: Multiple historical vulnerabilities

Novelty Indicators:

• Recent (<2 years) emulated NIC implementations
• Custom network card emulation (not standard)
• Performance-enhanced NIC variants

2.3 Storage Controllers

# Check storage controllers
lspci 2>/dev/null | grep -i storage

# Check for vulnerable storage controllers
# IDE: CVE-2020-14364 (QEMU AHCI)
# SCSI: CVE-2015-7504 (QEMU megasas)
# USB: CVE-2020-14372 (QEMU EHCI)

---

Phase 3: Memory Mapping Exploitation

3.1 EPT Violations

# Check Extended Page Tables (Intel VT-x)
# EPT poisoning allows host memory access from guest
# Detection: Check if EPT violations are logged
dmesg | grep -i ept
dmesl | grep -i "kvm.*ept"

# Check for nested virtualization
cat /proc/cpuinfo | grep -i "hypervisor\|vme"
lscpu | grep -i virtualization

EPT Violation Exploitation:

// Conceptual EPT violation exploit
// Requires: Vulnerable hypervisor, knowledge of EPT structure

// 1. Map guest physical page that points to host physical address
// 2. Trigger EPT violation with carefully crafted access
// 3. If hypervisor doesn't validate properly → host memory access

// Detection: Recent KVM/QEMU versions validate EPT more strictly

3.2 Dirty Page Handling

# Check memory dirty bitmap
# Dirty page tracking bugs can allow host memory disclosure

# Check KVM module version
modinfo kvm_intel | head -5  # Intel
modinfo kvm_amd | head -5    # AMD

# Check for CVE-2018-16871 (KVM mmu)

# Novelty: Look for recent dirty page handling changes
# - Recent Linux kernel KVM patches
# - Custom hypervisor implementations

---

Phase 4: Hardware-Assisted Virtualization Bugs

4.1 VMX/VMCS Vulnerabilities (Intel VT-x)

# Check VMX capabilities
# VMCS is the Virtual Machine Control Structure

# Check CPUID for VMX support
cpuid | grep -i vmx

# Check /dev/kvm access
ls -la /dev/kvm
groups | grep kvm

# Look for VMX-related CVEs:
# CVE-2018-12991: VMCS shadowing
# CVE-2019-20933: Nested virtualization

VMX Exploitation:

• VMCS shadowing allows guest-to-host escape
• Nested virtualization boundary issues
• VMFUNC/VMCLEAR privilege escalation

4.2 SVM/SVM Vulnerabilities (AMD-V)

# Check SVM capabilities
cpuid | grep -i svm

# Look for AMD-specific vulnerabilities:
# CVE-2021-29657: AMD SVC hypervisor interaction

4.3 RVI/VHE Bugs (ARM Virtualization)

# ARM virtualization extensions
# Check for VHE (Virtualization Host Extensions)

# On ARM guests:
cat /proc/cpuinfo | grep -i virtualization

# ARM-specific CVEs:
# CVE-2020-12351: ARM VPT (Virtual Page Table)
# CVE-2022-23960: ARM SVE (Scalable Vector Extension)

---

Novelty Indicators (PURSUE)

✓ Recent virtualization CVEs (2023-2024):

• CVE-2024-21626: Containerd (affects VM-based containers)
• CVE-2024-21111: VMware Authentication bypass
• CVE-2023-38408: Xen race condition
• CVE-2023-38416: Xen infinite loop

✓ Hypervisor-specific bugs:

• Custom hypervisor implementations
• Cloud provider hypervisor variants
• Embedded system hypervisors

✓ New device emulation:

• Recently added emulated devices
• Custom virtio implementations
• Performance-optimized device variants

✓ Side-channel research:

• Cache-based side channels across VM boundary
• Speculative execution variants (Spectre/Meltdown derivatives)
• Timing-based VM detection

---

Known Patterns (AVOID)

✗ Standard VMX/SVM exploits (well-documented) ✗ QEMU VirtIO buffer overflows (published CVEs) ✗ VMware Tools escape (known techniques) ✗ Hyper-V VMBus exploits (publicly disclosed)

---

Analysis Checklist

Hypervisor Identification

• Hypervisor type identified (QEMU, VMware, VirtualBox, Hyper-V, Xen)
• Hypervisor version determined
• Virtualization hardware extensions detected (VT-x, AMD-V, ARM V)
• Device emulation types catalogued

Vulnerability Scanning

• Hypervisor version checked against CVEs
• Emulated device versions enumerated
• Known vulnerable configurations tested
• Custom/novel devices identified

Exploitation Testing

• EPT violation testing (if applicable)
• VirtIO device fuzzing
• Memory mapping exploits attempted
• Side-channel testing
• Nested virtualization escapes

---

Quick Reference

Escape Vector	Detection	Novelty
VMX/SVM bugs	cpuid | grep -i vmx|svm	Medium
VirtIO overflow	ls /sys/bus/virtio/	Low (known)
EPT violation	dmesl | grep ept	Medium
Device emulation	lspci | grep -i net	High (if custom)
Nested virt	lscpu | grep Virtualization	Medium
Cache side-channel	Performance counters	High
Dirty page	modinfo kvm	Medium
Recent CVE	Hypervisor version	High
Custom hypervisor	Unusual dmi strings	Very High

---

Notes

• Focus on novel vectors: Recent CVEs, custom hypervisors, new device emulation
• Hardware-specific bugs: Intel VT-x, AMD-V, ARM VE have different attack surfaces
• Cloud platforms: AWS, GCP, Azure have custom hypervisors
• Verification: Document hypervisor version, exploit technique, impact
• Responsible disclosure: VM escapes are critical security issues