Januscape: Use-After-Free in Linux KVM x86 Shadow Paging

This repository is a small Linux-host-side hotpatch project, not a guest-to-host escape exploit. It contains a kernel module (KVM-XJ.c), a Makefile to build it against the running kernel, a README describing CVE-2026-53359 ('Januscape'), and a helper script (dump_tool.py) to identify the correct instruction offset in different kvm.ko builds. Core capability: the module dynamically resolves the kernel symbols kvm_mmu_get_page and text_poke using kallsyms_lookup_name, pauses CPUs with stop_machine, saves 6 original bytes from kvm_mmu_get_page+0x108, and overwrites them with a 6-byte NOP sequence. According to the README and code comments, this removes a conditional jump after a gfn comparison so the vulnerable shadow page reuse path is skipped and KVM falls back to allocating a new page. On module unload, the original bytes are restored. Repository structure: - KVM-XJ.c: main kernel module implementing the live patch. - Makefile: standard out-of-tree kernel module build instructions. - dump_tool.py: offline ELF parser/pattern matcher that scans a supplied kvm.ko for kvm_mmu_get_page and nearby compare/jump instruction patterns, then prints the likely patch offset. - README.md: explains the vulnerability, patch rationale, deployment steps, tested kernel versions, and operational caveats. There are no network callbacks, C2 endpoints, or remote targets in the code. The only meaningful observables are local kernel symbols and filesystem paths related to kernel module compilation and analysis. Because the code performs a real in-memory kernel text modification with a fixed payload and requires local root access, its maturity is best classified as OPERATIONAL. It is exploit-adjacent in that it targets a vulnerability, but its purpose is mitigation rather than exploitation.

This repository contains a real proof-of-concept exploit for CVE-2026-53359 ('Januscape'), a guest-to-host KVM/x86 escape vulnerability caused by a use-after-free in the shadow MMU path. The released exploit is not a full host-code-execution weapon; it is a kernel-module PoC intended to trigger a host denial of service by causing the host KVM kernel to panic. The repository is small and centered on one main code artifact: Januscape-V4bel/poc.c, supported by a Makefile and extensive Markdown documentation. Structure: the top-level README is mostly generic wrapper text plus a reference to the upstream Januscape material. The meaningful exploit content lives under Januscape-V4bel/: README.md explains the vulnerability, prerequisites, and usage; assets/write-up.md provides a detailed root-cause analysis and patch discussion; Makefile builds the kernel module; poc.c implements the PoC. The LICENSE is a research-use disclaimer. Exploit behavior: poc.c is a Linux kernel module for x86_64 guests. It supports both Intel and AMD paths via a module parameter (amd=1 for AMD, default Intel). It allocates pages, constructs nested page tables and guest memory structures, manipulates VMX/SVM state, and launches multiple kernel threads with roles such as writer, faulter, and optional flooders. These threads race nested virtualization activity to force the vulnerable host shadow MMU logic into reusing a child shadow page with the wrong role, eventually leading to rmap corruption and a host BUG/panic in pte_list_remove(). The code includes tunable parameters such as nvcpu, dwell, run_ms, diag, and nflood. Targeting: the exploit targets Linux KVM/x86 on Intel VMX/EPT and AMD SVM/NPT where nested virtualization causes the legacy shadow MMU path to be exercised. The documentation states the affected range spans from commit 2032a93d66fa to fix commit 81ccda30b4e8. It is specifically a hypervisor escape/DoS primitive from a guest VM, and the README notes that on systems exposing /dev/kvm as world-writable, the same bug class could also be adapted into a local privilege escalation scenario. Assessment: this is a legitimate exploit PoC, not a detector or fake sample. It is best classified as POC maturity because it provides a concrete trigger and impact (host panic) but does not ship the private full escape/RCE payload mentioned in the documentation.