A Linux kernel bug introduced in 2010 has reportedly been discovered inside KVM, where it has spent the last 16 years quietly aging like a cursed bottle of wine in the crawlspace of modern infrastructure.
The vulnerability, Januscape, can allegedly allow a malicious virtual machine to break out of its guest environment and run code as root on the host, which is cybersecurity language for “the raccoon is no longer in the attic; the raccoon owns the house.”
Even more spiritually damaging, some servers may be exposed despite not intentionally running virtual machines, because /dev/kvm has apparently been sitting around world-accessible like a bowl of Halloween candy labeled “please take one privilege escalation.”
Sysadmins are now being advised to patch, reboot, livepatch, unload kernel modules, modify permissions, verify CVEs, update testing repos, and generally perform the kind of sacred machine exorcism usually reserved for printers and Oracle licensing portals.
CloudLinux administrators, upon learning the bug dates back to 2010, were seen staring blankly at their terminals and whispering, “I was younger then. I had hope then.”
KernelCare, meanwhile, has arrived wearing a leather jacket and holding a fire extinguisher, promising to livepatch the situation while reboot windows sit in the corner, sweaty and unemployed.
At press time, the kernel stated it was “just a little race condition,” before immediately mapping the wrong memory, crashing the host, and asking if anyone had tried disabling all customer websites.