New VMScape Spectre-BTI Attack Targets Isolation Flaws in AMD and Intel CPUs

Cybersecurity researchers at ETH Zurich have disclosed a critical new Spectre-based attack named VMSCAPE that exploits incomplete branch predictor isolation in virtualized cloud environments, tracked as CVE-2025-40300. The attack targets the KVM/QEMU virtualization stack, enabling a malicious virtual machine to leak arbitrary memory from an unmodified hypervisor without any code modifications.

It affects a broad range of processors, including AMD Zen microarchitectures from Zen 1 through Zen 5 and Intel Coffee Lake, by exploiting incomplete isolation of branch prediction state across virtualization boundaries. On AMD Zen 4 processors, data exfiltration rates of 32 bytes per second were demonstrated, with disk encryption keys extractable within about 18 minutes, and the full attack chain taking around 1,092 seconds.

Following disclosure, Linux kernel maintainers implemented mitigation patches based on Indirect Branch Prediction Barrier on VM exits, with minimal performance impact in typical cloud scenarios. Cloud providers are urged to apply the kernel patches and consider additional hardening measures to protect multi-tenant environments where VMs could access cryptographic material from hypervisor processes.