Mastodawn

🐢🎩 Look! ETH Zürich's team of digital wizards just unearthed another mystical attack, VMScape! 💥 But wait—Xen's #microkernel struts around untouched, laughing at its fallen peers KVM and VMware. 🕵️‍♂️ Apparently, the new recipe for security involves adding a sprinkle of "microkernel" and a dash of "not giving a damn." 🤷‍♂️
https://virtualize.sh/blog/vmscape-and-why-xen-dodged-it/ #ETHZürich #VMScape #cybersecurity #Xen #HackerNews #ngated

VMScape and why Xen dodged it

ETH Zürich’s new VMScape attack hit KVM and VMware, but Xen’s microkernel-like design kept it out of reach.

Virtualize

Hacker News Sep 28

VMScape and why Xen dodged it

https://virtualize.sh/blog/vmscape-and-why-xen-dodged-it/

#HackerNews #VMScape #Xen #Virtualization #Tech #News #Analysis

VMScape and why Xen dodged it

ETH Zürich’s new VMScape attack hit KVM and VMware, but Xen’s microkernel-like design kept it out of reach.

Virtualize

Rene Robichaud Sep 15, 2025

L'attaque VMScape casse l'isolation des VM sur les puces AMD et Intel
https://www.lemondeinformatique.fr/actualites/lire-l-attaque-vmscape-casse-l-isolation-des-vm-sur-les-puces-amd-et-intel-97864.html

#Infosec #Security #Cybersecurity #CeptBiro #VMScape #VM #PucesAMD #Intel

L'attaque VMScape casse l'isolation des VM sur les puces AMD et Intel - Le Monde Informatique

Des chercheurs de l'école Polytechnique de Zürich ont trouvé une technique d'attaque contre l'isolation des machines virtuelles en s'appuyant sur des...

LeMondeInformatique

Thorsten Leemhuis (acct. 1/4)Sep 11, 2025

Mitigations for #vmscape have been merged to #Linux mainline and included in new stable and longterm #kernel versions released about an hour ago (like 6.16.7 or 6.12.47).

Vmscape is a vulnerability that essentially takes Spectre-v2 and attacks host userspace from a guest. It particularly affects hypervisors like #QEMU.

For more details see this #LinuxKernel merge commit https://git.kernel.org/torvalds/c/223ba8ee0a3986718c874b66ed24e7f87f6b8124, the doc changes in contains at https://git.kernel.org/torvalds/c/9969779d0803f5dcd4460ae7aca2bc3fd91bff12, or the following page from those that published the vulnerability:

https://comsec.ethz.ch/research/microarch/vmscape-exposing-and-exploiting-incomplete-branch-predictor-isolation-in-cloud-environments/

It is tracked as #CVE-2025-40300

https://www.cve.org/CVERecord?id=CVE-2025-40300

The DefendOps Diaries Sep 11, 2025

Virtualized environments may no longer be as safe as we thought. The new VMScape vulnerability lets guest systems peek into host data by exploiting shared CPU predictions. How vulnerable is your cloud?

https://thedefendopsdiaries.com/vmscape-attack-a-new-threat-to-virtualized-environments/

#vmscape
#virtualizationsecurity
#cloudsecurity
#cyberthreats
#amdintelvulnerability