Browse Definitions :
Definition

virtual machine escape

Virtual machine escape is an exploit in which the attacker runs code on a VM that allows an operating system running within it to break out and interact directly with the hypervisor.

Such an exploit could give the attacker access to the host operating system and all other virtual machines (VMs) running on that host. Although there have been no incidents reported in the wild, VM escape is considered to be the most serious threat to virtual machine security.

Virtual machines are designed to run in self-contained, isolated environments in the host. Each VM should be, in effect, a separate system, isolated from the host operating system and any other VMs running on the same machine. The hypervisor is an intermediary between the host operating system and virtual machines. It controls the host processor and allocates resources as required to each guest operating system. 

Here's Ed Skoudis' explanation of the risk:

"If the attacker can compromise the virtual machines, they will likely have control of all of the guests, since the guests are merely subsets of the program itself. Also, most virtual machines run with very high privileges on the host because a virtual machine needs comprehensive access to the host's hardware so it can then map the real hardware into virtualized hardware for the guests. Thus, compromising the virtual machine means not only that the guests are goners, but the host is also likely lost."

To minimize vulnerability to VM escape, Skoudis recommends that you:

  • Keep virtual machine software patched.
  • Install only the resource-sharing features that you really need.
  • Keep software installations to a minimum because each program brings its own vulnerabilities.
This was last updated in April 2016

Continue Reading About virtual machine escape

Networking
  • network management system

    A network management system, or NMS, is an application or set of applications that lets network engineers manage a network's ...

  • host (in computing)

    A host is a computer or other device that communicates with other hosts on a network.

  • Network as a Service (NaaS)

    Network as a service, or NaaS, is a business model for delivering enterprise WAN services virtually on a subscription basis.

Security
  • WebAuthn API

    The Web Authentication API (WebAuthn API) is a credential management application program interface (API) that lets web ...

  • Common Vulnerability Scoring System (CVSS)

    The Common Vulnerability Scoring System (CVSS) is a public framework for rating the severity of security vulnerabilities in ...

  • Dridex malware

    Dridex is a form of malware that targets victims' banking information, with the main goal of stealing online account credentials ...

CIO
  • value stream management

    Value stream management is an emerging business process intended to gauge the flow of value into business resources and ...

  • audit program (audit plan)

    An audit program, also called an audit plan, is an action plan that documents what procedures an auditor will follow to validate ...

  • blockchain decentralization

    Decentralization is the distribution of functions, control and information instead of being centralized in a single entity.

HRSoftware
  • team collaboration

    Team collaboration is a communication and project management approach that emphasizes teamwork, innovative thinking and equal ...

  • employee self-service (ESS)

    Employee self-service (ESS) is a widely used human resources technology that enables employees to perform many job-related ...

  • learning experience platform (LXP)

    A learning experience platform (LXP) is an AI-driven peer learning experience platform delivered using software as a service (...

Customer Experience
  • Net Promoter Score (NPS)

    Net Promoter Score (NPS) is a metric that organizations use for assessing customer loyalty toward their brand, products or ...

  • B2C (business-to-consumer)

    B2C, or business-to-consumer, is a retail model where products or services move directly from a business to the end user who has ...

  • market segmentation

    Market segmentation is a marketing strategy that uses well-defined criteria to divide a brand's total addressable market share ...

Close