VMScape Spectre BTI attack breaks VM isolation on AMD and Intel CPUs

Researchers have demonstrated a Spectre-like CPU branch target injection attack that allows malicious virtual machine users to leak sensitive information from host hypervisors such as KVM/QEMU on Linux.

The new attack, dubbed VMScape, exploits the speculative execution feature of AMD and Intel CPUs to break the guest-host isolation layer in virtualized environments, including cloud infrastructure and data centers. VMScape was successfully demonstrated against the widely used KVM/QEMU hypervisor combination in its default configuration and was used to extract disk encryption keys from the host.

Tracked as CVE-2025-40300, VMScape builds on the same principles as the Spectre branch target injection (Spectre-BTI) vulnerability disclosed by Google researchers in January 2018. That disclosure sparked extensive research into speculative execution, leading to the discovery of dozens of related CPU flaws.

Speculative execution is a CPU performance optimization technique that predicts the code path a program will take when it encounters a conditional branch. The CPU executes instructions along the predicted path in advance and stores the results in its caches for faster access. Attacks like Spectre exploit this behavior by tricking CPUs into executing code paths that expose sensitive data in the cache, which attackers can then extract using side-channel techniques.

Although Intel and AMD introduced mitigations for Spectre-BTI in newer processors and through microcode updates for older CPUs, researchers from ETH Zurich have shown that these defenses are insufficient in virtualized environments.

“Our systematic analysis of protection-domain isolation shows that current mechanisms are too coarse-grained: on all AMD Zen CPUs, including the latest Zen 5, the branch predictor cannot distinguish between host and guest execution, enabling practical cross-virtualization BTI (vBTI) attack primitives,” the researchers wrote in their paper. “Although Intel’s recent CPUs offer better isolation, gaps still exist.”

Attacking user-node hypervisors

Existing Spectre-BTI mitigations primarily focus on preventing memory leaks from kernel space to user space. However, in virtualization, some hypervisor components, such as QEMU, run in user space and may handle sensitive data.

For example, KVM is a Linux kernel module that interfaces between a type-2 hypervisor like QEMU and CPU virtualization features (Intel VT or AMD-V), providing hardware acceleration for virtual machines. QEMU, in turn, manages VM creation and assigns virtual devices.

VMScape demonstrates a vBTI attack primitive between processes inside a VM (guest user) and QEMU processes on the host (host user), which is sufficient to leak sensitive information. In their proof-of-concept attack on QEMU running on an AMD Zen 4 CPU, researchers located the disk encryption key and exfiltrated it within 1,092 seconds at a rate of 32 B/s.

Linux kernel maintainers have already implemented mitigations for VMScape by adding an Indirect Branch Prediction Barrier (IBPB) on each VMEXIT instruction, which occurs when a guest executes a privileged instruction. Researchers found this mitigation introduces only marginal performance overhead in common scenarios.

“Most systems are vulnerable to some vBTI primitives,” the researchers noted. “Since VMScape only affects virtualized environments, systems that never run untrusted code in local VMs are not directly exploitable. Nevertheless, given the widespread use of cloud services, it is likely that you rely on infrastructure running on vulnerable hardware.”

The Xen hypervisor is not affected by this issue, but the impact on other hypervisors that do not rely on KVM, such as Microsoft Hyper-V, VMware, or VirtualBox, remains unclear. The researchers disclosed their findings to AMD, Intel, and the Linux kernel maintainers responsible for KVM.