Can a virtual machine (VM) "hack" another VM running on the same physical machine?

Totor asked:

Questions:

  • if a VM is corrupted (hacked), what do I risk on others VMs running on the same physical machine?
  • What kind of security issues is there between VMs running on the same physical host?
  • Is there (can you make) a list of those (potential) weaknesses and/or issues?

Warning:

I know many virtualization types/solutions exist, and may have different weaknesses. However, I’m mostly looking for general security issues about the virtualization techniques, rather than a particular vendor bug.

Please provide real facts, (serious) studies, experienced issues or technical explanations. Be specific. Do not (only) give your opinion.

  • Examples:

Two years ago, I’ve heard that there could be security issues related to the MMU (accessing other machines main memory, I think), but I don’t know if that is a practical threat as of today, or just a theoretical research subject.

EDIT: I also found this “Flush+Reload” attack capable of retrieving GnuPG secret keys on the same physical machine, by exploiting the L3 CPU cache, even if GnuPG runs on another VM. GnuPG has been patched since.

My answer:


In theory, no. The whole point of the hypervisor is to isolate virtual machines from each other.

In practice, there have been (and could be in the future) security bugs in various hypervisors which could allow one virtual machine to affect either the hypervisor or other virtual machines on the same host. Security measures such as sVirt (for KVM/QEMU) are intended to solve this problem.


View the full question and answer on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.