A high-severity vulnerability has been discovered in Kernel software that could allow an attacker to escape from a guest virtual machine (VM) and access the underlying host system. By exploiting a race condition in how the GPU processes commands, an attacker could read or write data outside of their allocated memory, leading to a complete compromise of the host machine, data breaches, and service disruption for all other VMs on the same host.

This vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition within the GPU firmware's command processing logic. An attacker with administrative or kernel-level privileges on a guest VM can send specially crafted, improper commands to the virtualized GPU. By timing these commands precisely, the attacker can alter memory pointers or data size parameters after the system has checked them for validity but before they are used, causing the GPU to perform a read or write operation outside of the guest VM's intended memory boundaries. This out-of-bounds access on the host system's memory space allows the attacker to break out of the virtual machine, potentially leading to arbitrary code execution on the host.

This vulnerability presents a significant risk to the organization, classified as High severity with a CVSS score of 7.4. Successful exploitation would result in a complete loss of confidentiality and integrity for the virtualization host and all guest VMs it contains. This is particularly critical in multi-tenant environments, where an attacker compromising one guest could gain access to the data and operations of other clients. The potential consequences include major data breaches, theft of sensitive intellectual property, disruption of critical business services, and a complete compromise of the virtualized infrastructure, leading to significant financial and reputational damage.

Immediate Action: The primary remediation is to apply the security updates provided by the vendor to all affected host systems immediately. After patching, system administrators should actively monitor hypervisor and guest logs for any signs of exploitation attempts that may have occurred prior to the update.

Proactive Monitoring: Implement enhanced monitoring on virtualization hosts. Watch for anomalous GPU activity, unexpected performance spikes, or GPU-related errors and crashes originating from guest VMs. Monitor hypervisor logs for memory access violation errors and look for any unusual network traffic patterns between VMs or from a VM to the host management interface.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce risk:

• Disable or restrict GPU passthrough and virtualization features for non-essential or untrusted guest VMs.
• Isolate VMs running critical workloads or containing sensitive data onto dedicated, patched physical hosts.
• Enhance network segmentation to prevent lateral movement from a potentially compromised VM.

Public Exploit Available: false

Given the high severity (CVSS 7.4) and the critical impact of a successful VM escape, we strongly recommend that organizations prioritize the immediate patching of all vulnerable virtualization hosts. This vulnerability represents a direct threat to the security of the entire virtualized environment. While this CVE is not currently on the CISA KEV list, its severity warrants treating it with the highest urgency to prevent potential compromise of host systems and the sensitive data they manage.