VMScape (CVE-2025-40300): A New CPU Flaw Threatens Cloud Security

Security researchers at ETH Zurich have revealed VMScape (CVE-2025-40300), a practical end-to-end Spectre-BTI exploit that can allow a malicious guest to leak memory from unmodified QEMU processes running on an AMD Zen 4 host at a rate of 32 bytes per second, potentially exposing cryptographic keys used for disk encryption.

The work describes VMSCAPE as the first such attack able to breach virtualization boundaries by targeting the branch predictor state, affecting AMD Zen generations 1–5 and Intel Coffee Lake CPUs. According to the study, the attacker can exfiltrate data directly from the hypervisor, highlighting how a compromised guest VM could peer into or interfere with neighbouring VMs and associated host processes.

ETH Zurich disclosed findings to AMD and Intel in June 2025, and the Linux kernel community has since developed mitigations, notably Indirect Branch Prediction Barrier (IBPB)-on-VMEXIT, which the researchers say incurs only a marginal performance overhead in common scenarios. VMSCAPE is tracked under CVE-2025-40300, and mitigations have been adopted in Linux patches to reduce risk. According to the authors, the new protections do not fully erase the vulnerability, underscoring ongoing concerns for cloud isolation.