Nutanix AHV

Nutanix AHV is the company's native hypervisor, built on KVM with QEMU-derived device emulation. What distinguishes it is the hyperconverged architecture: each node runs a Controller VM (CVM) that provides the distributed storage fabric and hosts the management services, with the Prism interface (per-cluster Element and multi-cluster Central) on top. Offensively, the guest-to-host escape is the familiar QEMU device surface, but the high-value targets are the Controller VM, which mediates storage and management, the Prism API, and the distributed storage that holds every VM's virtual disks.

# on an AHV host: KVM/QEMU plus the Nutanix stack
ps -ef | grep -E 'qemu|acropolis' | grep -v grep
# the Controller VM runs the storage and management services
virsh list --all 2>/dev/null | grep -i cvm

Subtopics#

• Guest-to-host escape: breaking out of an AHV VM via QEMU device models.
• Host access and shell: execution on the AHV host and the Controller VM.
• Management plane: the Prism API and Controller VM services.
• Disk and snapshot theft: taking vdisks from the storage fabric.
• Known escape exploits: the inherited QEMU and Nutanix-specific bugs.

References#

• Nutanix AHV documentation
• Nutanix security advisories
• QEMU security