Xen is a type-1 hypervisor: a thin hypervisor runs on the hardware, and a privileged control domain (dom0) hosts the toolstack and, for most configurations, the backend halves of the guests' paravirtual devices. Guests (domUs) reach host functionality through hypercalls to the hypervisor and through the split paravirtual driver model, where a frontend in the guest talks to a backend in dom0 (or a driver domain) using shared memory via grant tables and notifications via event channels. The escape surface is therefore the hypercall interface, the grant-table and event-channel machinery, and the backend drivers, plus the usual guest-disk theft and the management toolstack.
# in a Xen guest
dmesg | grep -i xen; ls /sys/bus/xen* 2>/dev/null
cat /sys/hypervisor/type 2>/dev/null # "xen"
# in dom0: the toolstack and domains
xl list 2>/dev/null
Subtopics#
- Guest-to-host escape: hypercalls, grant tables and event channels, and backend drivers.
- Host access and shell: execution in dom0.
- Management plane: the Xen toolstack and XAPI.
- Disk and snapshot theft: taking guest virtual disks.
- Known escape exploits: the recurring hypercall and backend bugs.