VulnerabilityPublished 22 Sep 2025

VMScape attack | Kaspersky official blog

Source Kaspersky Security Blog

Mentioned vulnerabilities

CVE-2025-40300

Severity

Medium

Rated by Threat Radar

Data as of 7 Oct 2025, 01:34 UTC

What to do

AI-suggested

1. Apply the Linux kernel patch addressing CVE-2025-40300 promptly to all affected systems running virtualized workloads. 2. Enable and configure hardware-based virtualization security features such as AMD Secure Encrypted Virtualization (SEV) and SEV-SNP or Intel Trusted Domain Extensions (TDX) to encrypt VM memory and prevent direct data leakage. 3. Audit virtualization infrastructure to identify servers running vulnerable AMD Zen (1-5) or Intel Coffee Lake CPUs and prioritize their patching or hardware upgrade. 4. Implement strict tenant isolation policies and monitor VM behavior for anomalous cache timing or side-channel attack indicators. 5. Regularly update hypervisor and host OS software to incorporate latest security fixes and mitigations for speculative execution vulnerabilities. 6. Employ microarchitectural side-channel attack detection tools where available and integrate them into security monitoring. 7. Educate cloud administrators and security teams about the nature of Spectre-based VM escape attacks to improve incident response readiness. 8. Consider workload placement strategies that avoid co-locating sensitive VMs on vulnerable hardware without mitigations. 9. Collaborate with cloud providers to ensure underlying infrastructure is protected against VMScape and similar attacks. 10. Maintain a robust patch management and vulnerability assessment program focused on CPU and virtualization security.

Description

VMScape is a practical Spectre v2 side-channel attack targeting virtualized environments, demonstrated by ETH Zurich researchers. It exploits branch target injection to bypass privilege separation between host and guest OS during speculative execution, allowing data leaks from host memory via a virtual machine. AMD Zen CPUs (1st to 5th gen) and Intel Coffee Lake CPUs are vulnerable, with AMD’s Secure Encrypted Virtualization (SEV) providing some protection. The attack can steal sensitive data like encryption keys at a rate of 32 bytes per second with high reliability. Although no known exploits are in the wild, the vulnerability (CVE-2025-40300) has been patched in the Linux kernel. The attack is particularly relevant for cloud providers and virtualized environments where multiple tenants share hardware. European organizations using vulnerable AMD or older Intel servers in cloud or data center environments face confidentiality risks. Mitigations include applying Linux kernel patches, enabling hardware-based encryption technologies like AMD SEV or Intel TDX, and reviewing virtualization security configurations.

Impact

For European organizations, especially cloud service providers, data centers, and enterprises relying on virtualized infrastructure, VMScape poses a significant confidentiality risk. Attackers gaining access to a single virtual machine could potentially extract sensitive data from the host or adjacent VMs, including encryption keys, intellectual property, or customer data. This undermines tenant isolation, a cornerstone of cloud security, and could lead to data breaches, regulatory non-compliance (e.g., GDPR violations), and reputational damage. The attack’s ability to bypass common kernel-level defenses and operate without host compromise increases its stealth and potential impact. Organizations using AMD Zen-based servers or older Intel Coffee Lake processors in their virtualization stacks are particularly vulnerable. Although mitigations exist, failure to apply patches or enable hardware encryption features could leave critical infrastructure exposed. The attack also raises concerns about multi-tenant cloud environments prevalent in Europe, where shared infrastructure is common. However, the absence of known exploits in the wild and the availability of patches and hardware protections reduce immediate risk, though the threat remains relevant for future attack scenarios.

Summary

VMScape is a newly demonstrated side-channel attack leveraging the Spectre v2 vulnerability in CPU speculative execution to escape virtual machine isolation and access host memory. Researchers at ETH Zurich developed a practical attack called Virtualization-based Spectre-BTI (vBTI) that exploits branch target injection, a method to manipulate CPU branch prediction, to induce speculative execution paths that leak sensitive data into CPU caches. By measuring cache side effects, attackers can extract secrets such as encryption keys from the host system while operating solely within a guest virtual machine with default settings. The attack was tested on AMD CPUs from the Zen 1 through Zen 5 architectures and Intel Coffee Lake processors, with AMD systems showing higher susceptibility due to architectural differences and incomplete Spectre mitigations. Intel’s newer architectures have improved protections that block this attack. The data exfiltration speed is approximately 32 bytes per second with near-perfect reliability, sufficient to steal cryptographic keys and other sensitive information. This attack bypasses common defenses like Kernel Address Space Layout Randomization (KASLR) and does not require malware on the host or hypervisor compromise, making it a realistic threat in multi-tenant cloud environments. The vulnerability was assigned CVE-2025-40300 and patched in the Linux kernel, with minimal performance impact. Hardware-based encryption technologies such as AMD’s Secure Encrypted Virtualization (SEV) and SEV-SNP, as well as Intel’s Trusted Domain Extensions (TDX), provide additional layers of defense by encrypting VM memory and preventing direct data leakage. While no active exploits have been observed in the wild, VMScape highlights the evolving threat landscape of speculative execution attacks in virtualized cloud infrastructures and underscores the need for continued vigilance and patching.

References

kaspersky.com/blog/vmscape-spectre-attack/54377/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 7 Oct 2025, 01:34 UTC

References

Community reviews

Related threats