3 ms·
Just pointing out the most VM / virtualization platforms have also had security problems where an attacker could escape the VM and access the underlying operati
by mrweasel 3y ago
Just pointing out the most VM / virtualization platforms have also had security problems where an attacker could escape the VM and access the underlying operating system.
- flaminHotSpeedo 3y agoThe major difference is that VM's are intended to be a security boundary as a primary function, and give you tools like hardware virtualization or enforcing single tenancy for a given NUMA node to reduce the attack surface.
- tptacek 3y agoKVM vulnerabilities are rare compared to Linux kernel LPEs, which makes sense, because KVM is a relatively small part of the Linux kernel compared to the system call and driver attack surface. Containers are great, but shared-kernel security isolation of standard Unix programs doesn't work.