A Xen domU reaches outside itself through well-defined interfaces, and each is an escape surface. Hypercalls are the guest's direct calls into the hypervisor, so a flaw in hypercall handling corrupts or subverts the hypervisor itself. Grant tables and event channels are how domains share memory pages and signal each other; mismanagement there bridges a guest into dom0 or hypervisor memory. And the paravirtual backend drivers (block, network) running in dom0 parse the ring requests a guest frontend posts, so a backend bug gives code execution in the privileged dom0. The target is whichever of these the configuration exposes, PV, PVH, and HVM guests reach somewhat different mixes.
# the PV interfaces visible in a Xen guest
ls /sys/bus/xen-backend 2>/dev/null; ls /dev/xen 2>/dev/null
cat /proc/xen/capabilities 2>/dev/null
dmesg | grep -iE 'grant|event channel|xenbus'
Subtopics#
- Hypercalls: the guest-to-hypervisor call interface.
- Grant tables and event channels: the inter-domain memory and signal machinery.
- PV backend drivers: the dom0 backend halves of paravirtual devices.