ARM is everywhere in the cloud now — and this month brought a reminder of what that means for isolation…
Liam R. — Freelance Penetration Tester
ARM is everywhere in the cloud now — and this month brought a reminder of what that means for isolation.
ITScape (CVE-2026-46316) is, as far as anyone publicly knows, the first guest-to-host escape targeting KVM/arm64. It's a use-after-free deep in the kernel's vGIC-ITS interrupt emulation, not the usual QEMU user-space bug, so a malicious guest gets host kernel privileges. CVSS 9.3, public PoC, and especially relevant to multi-tenant arm64 clouds.
That landing the same week I was expanding my open-source container-escape auditor felt timely, so it's now in the database.
https://github.com/liamromanis101/K8s-container_escape_audit
The latest K8s-container_escape_audit update brings it to 51 read-only checks and 21 tracked CVEs, with new coverage for io_uring, kTLS/sockmap, Kata Containers, and arm64 KVM exposure, plus architecture-aware CVE gating so arm-only issues like ITScape don't false-positive on x86 hosts, and an interim mitigation attached to every finding.
It runs inside any container, changes nothing, and keeps its CVE database separate from the script so it stays current without code changes.
For authorised security testing only.
#ContainerSecurity #Kubernetes #CloudSecurity #ARM64 #InfoSec #DevSecOps
1 reactions · 0 comments
Topics: #devsecops, #kubernetes, #cloudsecurity, #containersecurity, #infosec, #arm64