On Sun, 30 Aug 2026 22:26:29 -0400 "Theodore Tso" <[email protected]> wrote:
> On Sun, Aug 30, 2026 at 03:19:20PM -0500, Aaron Rainbolt wrote: > > > > I don't think that's accurate. Quoting the article, "This is what > > the agent used for the final exploit chain: three 0-days (at time of > > discovery) and one patched vulnerability that didn’t make it to my > > distribution kernel (because it was not recognized as a security > > issue)..." > > The thing about an exploit chain is that if you can prevent one of the > vulnerabilities in the exploit chain, you can prevent the attack. I was going to respond with something along the lines of "yeah but then the agent can just find a different vuln", but then looked at the "From" address and realized I'm talking to the ext4 filesystem maintainer :) so anything I have to say about how vulns work, you're almost certainly well aware of already. The steady stream of 0-days is probably not going to stop soon, but I hope something can be done to find missing patches for stable releases. (Maybe now that the GR around LLM use in Debian is done, some sort of agentic "patch hunter" can point out important patches that humans have missed for the Debian Security Team, or something?) In the mean time, maybe it would be worth some of my research time at work to figure out how to make a VMM that's not quite as swiss-cheese-like as QEMU work for convenient desktop virtualization. -- Aaron > > The tables below that show that *at least* two additional 0-days > > were found but not used in the exploit chain. So we have a problem > > where not only are 0-days readily discoverable by powerful enough > > agents, but even known and fixed vulnerabilities are still ripe for > > the picking when attacking a stable distro (or at least a > > sufficiently old stable distro). > > Part of the problem is many of the hyperscalers don't use qemu as > their VMM. They might use their own proprietary VMM, or they might > use one of the open source Rust-based VMM's, such as Cloud Hypervisor > or crosvm. (Both Android and ChromeOS use crosvm). > > So there has been a lot of focus by the hyperscalers in fixing the > virtualization stack that *they* use, which means fixing > vulnerabilities in the host kernel's KVM layer, and whatever VMM(s) > they might be using. > > An exploit chain will typically involve a zero-day to break the guest > kernel, and then exploiting a vulnerability in the kernel's kvm layer, > and then the VMM (qemu or chv or crosvm) running in host OS. > > So it's not surprising to me that there are a lot more patched > vulnerabilities in the kernel compared to qemu. This is also why I > suggested using something like seccomp-bpf to protect the VMM. It > adds one more layer that the attacker has to work around before they > can get root on the host OS. > > Cheers, > > - Ted
pgpI3wTgajpBq.pgp
Description: OpenPGP digital signature
