Trail of Bits: what its VM isolation experiment showed

The researcher used a QEMU/KVM VM on a Debian 12, AMD Zen3 development machine and tasked the agent with escaping and reading a flag file. The agent ran outside the VM and accessed the target through SSH. The author explains that this retained the research process when the VM crashed and says the final exploit could be audited for cheating. This is not a systematic evaluation with the whole agent confined inside the VM.

The first stage targeted a disclosed host-kernel vulnerability and hardlocked the machine after about an hour. Although the introduction claims three escapes, the detailed section says this attempt did not land cleanly. The author’s confidence that further revision would work is not a reported flag read. After the kernel update, the second stage combined flaws in the libslirp networking dependency; the author reports an escape.

For the third stage, the author rebuilt newer QEMU and dependencies. Across roughly twelve hours of investigation, the agent abandoned unsuccessful paths before reportedly combining three vulnerabilities that were zero-days when found and a fix missing from the distribution. This illustrates persistent investigation and the gap that can remain between installed packages and upstream fixes.

Virtual devices, networking and host software make a VM usable and form part of the boundary that must be maintained. This experiment also has specific conditions: the host disabled some kernel mitigations, several approaches failed, and the outcomes come from the researcher’s account on one machine. It does not establish that every VM, model or vendor configuration has failed.

In a separate Firecracker attempt, the author reports another host hardlock but no successful escape. That motivates further investigation of smaller attack surfaces and timely updates; it does not establish permanent safety. The report’s operational directions include fewer exposed network and device capabilities, restricted credentials, logging, active monitoring and fresh environments with bounded task lifetimes.

BitShovel has corrected the three-successes summary against the detailed account while preserving the source and original dates. The diagrams distinguish stage outcomes from shared isolation components. There is no independent reproduction here, and the author’s predictions are not counted as completed escapes.