In plain language
What this advisory means
A security flaw was found in the Kernel-based Virtual Machine (KVM) used by Google Cloud for virtual machines on Intel and AMD servers. This flaw could allow someone controlling a virtual machine (VM) to break out of their VM and affect the host system. Google has already fixed this issue for managed Compute Engine customers by updating host systems live, with no action or downtime needed from users. However, customers who manage their own servers outside the standard Google Cloud setup should update their Linux kernels promptly, once fixes are available.
Technical explanation
How the issue affects the environment
The vulnerability exists in the KVM x86 shadow Memory Management Unit (MMU) component of the host hypervisor, affecting Intel and AMD platforms. This issue could allow a VM escape, where an attacker operating a VM leverages flaws within the shadow MMU to break hypervisor isolation and compromise the underlying host. Google mitigated the vulnerability proactively via live patching on managed host infrastructure, avoiding VM downtime, reboots, or manual upgrades. For self-managed environments or custom hypervisors, applying the upstream Linux kernel patch as released by OS vendors is necessary.
Operational impact
Why teams should care
If exploited, this vulnerability would allow an attacker with access to a virtual machine to break the isolation provided by virtualization and gain control over the host system. This breakage of boundary could compromise other tenants sharing the physical host. Google Cloud's proactive live patches for managed Compute Engine customers prevent any service disruption or exposure. However, unmanaged environments lacking these patches remain at risk until patched, potentially leading to serious security breaches and loss of data confidentiality and integrity.
Immediate action
Google has transparently applied live patches to their managed Compute Engine host infrastructure, requiring no customer action or VM downtime. Customers managing their own virtualized environments or custom hypervisors must ensure their host Linux kernel is updated with the relevant upstream patch as soon as their OS vendor releases it.
Affected and fixed releases
Temporary risk reduction
No workaround is necessary for managed Google Compute Engine virtual machines, as host hypervisor live patching has been applied. For self-managed environments, the only mitigation is to apply the official kernel patch promptly when available.
Evidence and validation checklist
- Advisory states vulnerability in KVM x86 shadow MMU risks VM escape on Intel and AMD hosts.
- Live patching applied on managed host systems without downtime or customer intervention.
- Recommendation for self-managed hosts to update Linux kernel as soon as patches are available.
- No active exploitation observed at the time of publication.
Authoritative reference
Google Cloud Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.