VM Escape and Hypervisor Security: Where Isolation Actually Breaks
Virtualization's security promise is isolation: a guest cannot reach the hypervisor or other guests. VM escape is the failure of that promise — code running inside a guest reaching the host. It is rare, it is severe, and understanding where the attack surface actually lives is more useful than the term itself. Type 1 and Type 2 A Type 1 or bare-metal hypervisor runs directly on the hardware. Less code sits beneath the guests, so there is less to attack, which is why production virtualization uses this model. A Type 2 or hosted hypervisor runs as an application on a conventional operating system. Everything in that host operating system — its drivers, its services, its other applications — is additional attack surface beneath the guests. Fine for development and a poor choice for isolating anything you care about. Where the attack surface actually is The hypervisor's core — memory management, scheduling, the instruction handling that keeps guests separate...