QEMU provides the device emulation for a KVM virtual machine while the KVM kernel module accelerates CPU and memory virtualization. A guest cannot touch the host CPU path, so escapes target the QEMU user-space process: its device models read guest-driven I/O (port and MMIO register writes) and walk DMA descriptors and ring buffers the guest places in its own memory. A memory-safety flaw in any device model yields code execution in the QEMU process, which runs on the host with the privileges of whoever launched the VM (often reduced by seccomp and sometimes confined, but still a host process). Because the device models are shared, these bugs recur across every KVM-based product.
# from the guest: enumerate the emulated devices (the escape surface)
lspci -nn # virtio, e1000/rtl8139, USB controllers, audio
lsusb; cat /proc/ioports # I/O-port devices incl. the legacy floppy (0x3f0-)
dmesg | grep -i virtio
Subtopics#
- virtio devices: the paravirtual virtqueue device family.
- Network adapters: emulated e1000, rtl8139, and virtio-net.
- USB controllers: emulated UHCI, EHCI, and XHCI.
- Block and SCSI: the IDE/AHCI and virtio-blk/SCSI storage paths.
- Audio devices: the emulated sound cards.
- Floppy controller: the legacy floppy disk controller.