QEMU is the user-space device emulator that pairs with the KVM kernel module to run virtual machines, and it underlies most Linux virtualization: libvirt, Proxmox, OpenStack, oVirt, cloud platforms, and more. Its offensive surface is therefore the common denominator of KVM-based products. The central concern is the guest-to-host escape through QEMU's device models; alongside it are the QMP/HMP monitor that controls a running VM, the qcow2 disk images and snapshots that hold guest data, and the host QEMU runs on. Because every KVM product reuses these device models, a QEMU escape bug tends to apply everywhere.
# from the guest: the emulated device inventory (escape surface)
lspci -nn; lsusb; cat /proc/ioports | head
# from the host: QEMU processes and their monitor sockets
ps aux | grep qemu; ls -l /var/lib/libvirt/qemu/*.monitor 2>/dev/null
Subtopics#
- Guest-to-host escape: breaking out through QEMU device models.
- Management plane: the QMP/HMP monitor and libvirt control.
- Disk and snapshot theft: stealing qcow2 images and snapshots.
- Host access and shell: execution on the QEMU host.
- Known escape exploits: the recurring device-model escapes.