Ulwazi lukhishwe muva nje mayelana nokuba sengozini okubeka amaseva amafu engozini. Lokhu kuba sengozini kuvumela abahlaseli ukuthi balawule ngokuphelele umshini ongokoqobo , isimo esibi kakhulu kubahlinzeki bezingqalasizinda zamafu.
I-Zapscape, ebhaliswe ngaphansi kwesihlonzi i-CVE-2026-64561, iwubuthakathaka obubalulekile ku-Linux KVM hypervisor eveza ingozi amapulatifomu amaningi ayithatha ngokungaqondile ngokunika amandla i-virtualization ehlanganisiwe. Lokhu buthakathaka kuvumela umhlaseli onamalungelo e-kernel kumshini obonakalayo (L1) ukuthi asebenzise ikhodi enamalungelo ezimpande ohlelweni lomsingathi (L0), ephula ukuhlukaniswa kwezindawo ezibonakalayo.
Njengoba ibhekwa njengosongo olunomthelela omkhulu, i-Zapscape ayigcini nje ngokwenza kube lula ukubaleka emshinini obonakalayo, kodwa futhi ivula indlela yokukhulisa amalungelo endawo kubasebenzisi abaphethe abanezimvume zokubhala kudivayisi ye-/dev/kvm.
Nakuba izinhlangano ezifana neRed Hat zilinganise ubuthakathaka ngamaphuzu e-CVSS angu-7.0 agxile ekungazinzini nasekunqatshweni kwenkonzo, ubufakazi bomphakathi bomqondo (i-PoC) bubonisa ububanzi obubhubhisa kakhulu: ukudalwa kwefayela elingahleliwe ngqo empandeni yomsingathi.
Isiphithiphithi kuyunithi yokuphatha inkumbulo
Indlela i-Zapscape esebenza ngayo ifihliwe ngaphakathi kwe-KVM's Memory Management Unit (MMU) kanye nendlela i-hypervisor ephatha ngayo amathebula ekhasi lapho isivakashi esisodwa (L1) sisebenza njenge-hypervisor kwesinye isivakashi esincane (L2). Inkinga isephutheni lokuhleleka okunengqondo ngesikhathi sokuphathwa kwephutha lekhasi. Ezindleleni zekhodi ye-kernel, ukuhlolwa "kwempande ephelelwe yisikhathi" kwenziwa ngaphambi komsebenzi wokubuyisa ikhasi, esikhundleni se-after.
Lokhu kulandelana okungalungile kubangela isimo esivamile sokusetshenziswa ngemva kokungasebenzi . Ngesikhathi sokubuyiselwa, i-KVM ingasusa impande eyisebenzisayo bese iyimaka njengengasebenzi. Kodwa-ke, ngenxa yokuthi ukuhlolwa kwezempilo sekuvele kuqalile, uhlelo luyaqhubeka nokwakha amamephu ngaphansi kwempande engasasebenzi. Ngokuthakazelisayo, le nkinga yokuhlunga ibilokhu ikhona kukhodi kusukela ngo-2008, kodwa yaba yinto ebalulekile futhi engasetshenziswa ngemva kokukhishwa kwe-Linux kernel 5.9 ngoJulayi 2020 , lapho kwethulwa umyalelo wokuthi uhlelo luyeke ukuphoqelela.
Izidingo kanye nemikhawulo
Ukuze i-Zapscape isetshenziswe, imvelo kumele ihlangabezane nezidingo ezithile kakhulu. Okokuqala, i-virtualization ehlanganisiwe kumele inikwe amandla kumojuli ye-KVM, ukucushwa okuvumela ukwakheka kwezigaba ezintathu (L0, L1, kanye ne-L2). Umhlaseli udinga ukuqala ukuhlasela kusukela kungqimba lwe-L1 , oludinga amalungelo ezimpande kulowo mshini obonakalayo. Ukusuka lapho, umhlaseli ulawula izindlela zememori ngenkathi umsebenzi wesivakashi esingaphansi kwe-L2 uphoqa umphathi we-L0 ukuthi aqale ukubuyisa ikhasi le-quota, okubangela ukonakala kwememori.
Ezingeni lehadiwe, izimo ziyahlukahluka kuye ngomkhiqizi. Kumasistimu e-AMD asebenzisa amatafula ekhasi anezidleke ( i-SVM ), ubuthakathaka bulula kakhulu futhi abudingi ezinye izici. Ngokuphambene nalokho, kumaprosesa e-Intel, isimo sidinga ukuthi isivakashi se-L1 siveze amakhono okuhamba ngekhasi e-EPT asezingeni ezine nelesihlanu . Lokhu kukhawulela i-vector yokuhlasela ku-Intel ezakhiweni zakamuva, ikakhulukazi kusukela emndenini we-Ice Lake-SP kuqhubeke.
Kuyaphawuleka ukuthi, nakuba ubufakazi bomphakathi bomqondo bukwazile ukubalekela kumphathi ezindaweni ezilawulwayo, abacwaningi bezokuphepha babike ukuthi kwezinye izinhlayiya ezihlanganisiwe kabusha, ukuxhashazwa kumane kuphahlaze umshini obonakalayo womhlaseli, okusebenza njengokunqatshelwa kwenkonzo kunokuba kube ukuphunyuka okuphelele.
Ukunciphisa, ama-patches namasu
Isixazululo esiqondile se-Zapscape sifike ezindaweni zokugcina ze-Linux ngoJulayi odlule nge-patch elungisa i-oda lokuqinisekisa. Lokhu kulungiswa kususa ukuhlolwa kwezimpande ezindala ukuze kwenzeke ngemuva kokwabiwa kwekhasi le-MMU, okuqinisekisa ukuthi i-hypervisor ayidali amamephu asebenzayo ngaphansi kwempande esusiwe. Lokhu kulungiswa sekuvele kusetshenziswe emagatsheni e-kernel azinzile futhi kusatshalaliswa kabanzi ngokusabalalisa okuhlukahlukene.
Kubaphathi abangakwazi ukuthuthukisa ngokushesha, kukhona izindlela zokunciphisa zesikhashana ezisebenzayo kakhulu. Isenzo esibalulekile ukukhubaza i-virtualization ehlanganisiwe kuwo wonke amaseva lapho kungadingeki khona ngokuphelele ngokudlulisela ipharamitha ethi `nested=0` kumamojula we-`kvm_amd` noma we-`kvm_intel` kumafayela wokucushwa kwe-modprobe. Lesi sinyathelo sidinga ukulayisha kabusha imojula, okusho ukumisa noma yimiphi imishini ebonakalayo esebenzayo.
Okokugcina, uma unesithakazelo sokufunda okwengeziwe, ungathola imininingwane kusixhumanisi esilandelayo.