Full Report
RL has documented CVE-2026-46316, and developed two YARA rules to help detect exploits of the multi-tenant cloud vulnerability.
Analysis Summary
# Vulnerability: ITScape Guest-to-Host Escape in KVM/arm64
## CVE Details
- **CVE ID:** CVE-2026-46316
- **CVSS Score:** Not explicitly listed in text (Implied Critical/High due to host kernel code execution)
- **CWE:** CWE-416 (Use-After-Free) / CWE-362 (Race Condition)
## Affected Systems
- **Products:** Linux Kernel (KVM/arm64 virtualization)
- **Versions:** Affected from commit `8201d1028caa` (2024-04-25) through `13031fb6b835` (patched 2026-06-05).
- **Configurations:** Multi-tenant ARM64 cloud environments utilizing KVM with in-kernel GIC-ITS (Interrupt Translation Service) emulation.
## Vulnerability Description
ITScape is a guest-to-host escape vulnerability residing in the `vGIC-ITS` emulation within the ARM64 KVM hypervisor. The flaw is caused by a race condition in the `vgic_its_invalidate_cache()` function, which results in a "double-put" use-after-free (UAF) condition.
Unlike many escapes that target user-space emulators (like QEMU), this vulnerability exists entirely within the kernel-level KVM code. Consequently, successful exploitation grants the attacker root privileges on the host kernel directly, bypassing typical user-space sandboxing.
## Exploitation
- **Status:** PoC available (Disclosed by researcher Hyunwoo Kim).
- **Complexity:** Medium (Requires triggering a specific race condition; may require chaining with local privilege escalation if the attacker is not already root within the guest).
- **Attack Vector:** Network (Targeting cloud guests) to Local (Host escape).
## Impact
- **Confidentiality:** Total (Full host kernel access).
- **Integrity:** Total (Full host kernel access).
- **Availability:** Total (Host crash or complete takeover).
## Remediation
### Patches
- **Mainline Linux Kernel:** Apply patch at commit `13031fb6b835` and associated companion fixes for CVE-2026-46316.
### Workarounds
- No specific software workarounds listed; priority is placed on updating the host kernel.
## Detection
- **Indicators of Compromise (IoCs):**
- **PoC SHA256:** `e0ab84da2d2783c8cae3624e8ce58b99ad79219753b249671ff7f743abdacc35`
- **Artifacts:** Look for the creation of `/ITScape` on the host file system (default behavior of the PoC's command string).
- **Detection Methods:**
- **YARA Rule 1 (ITScape_ExploitConstants_1):** Targets hardcoded 64-bit constants and kernel symbol addresses (e.g., `ORDERLY_POWEROFF`, `LEAKLEAD`) used in the exploit source.
- **YARA Rule 2 (ITScape_KVM_PrivDrop_1):** Uses behavioral detection for a specific ARM64 instruction sequence involving `stat(2)` checks on `/dev/kvm` followed by privilege dropping (`setgroups`/`setgid`/`setuid`).
## References
- **Researcher Disclosure:** oss-security (June 10)
- **Vendor Blog:** hxxps[://]www[.]reversinglabs[.]com/blog/defend-cloud-infrastructure-itscape
- **Patch Commit:** hxxps[://]git[.]kernel[.]org/pub/scm/linux/kernel/git/torvalds/linux[.]git/commit/?id=13031fb6b835