KVM (Kernel-based Virtual Machine) is the Linux kernel's virtualization engine: it uses hardware virtualization to run guest CPUs efficiently while a user-space Virtual Machine Monitor emulates the devices. That split defines the attack surface. The KVM kernel module exposes an interface (the /dev/kvm ioctls and the in-kernel acceleration of instructions, MMU, and some devices) that is itself an escape and privilege-escalation surface. The monitors, QEMU, the microVM monitors Firecracker and Cloud Hypervisor, provide the device models a guest escapes through. And the products built on KVM, QEMU-based platforms, Proxmox VE, and Nutanix AHV, each wrap it with a management plane that is its own target.
# host: KVM in use and which monitor
ls -l /dev/kvm; lsmod | grep kvm
ps -ef | grep -E 'qemu|firecracker|cloud-hypervisor' | grep -v grep
Subtopics#
- QEMU: the dominant device emulator behind KVM.
- Kernel module: the KVM kernel interface and nested virtualization.
- microVM monitors: Firecracker and Cloud Hypervisor.
- Proxmox VE: the KVM-based virtualization platform.
- Nutanix AHV: the KVM-based hyperconverged hypervisor.