Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm guessing that all guests would be screwed, if the hypervisor is hacked. I found this article, but it seems to be more focused on privilege escalation of guests. I'm more interested to hear about other exploits on hypervisor managers. Many providers use VM control panels like SolusVM. Wouldn't it mean that a security vulnerability in the admin control panel would allow getting control of an array of machines?

share|improve this question
Compromised? YES; Affected? Who knows. "Compromised" means risk, "Affected" is more vague .. – david6 Jan 28 '12 at 23:12
Revised to be more specific. Thanks. – m33lky Jan 28 '12 at 23:27
up vote 6 down vote accepted

Simple answer is yes. If an attacker controls the hypervisor they can potentially get access to everything within it, including the memory space of a VM (which could include keys)

Worst case is to assume all may be lost if the hypervisor is compromised, so in order to prevent this, a well structured, layered security architecture may make it incredibly difficult for an attacker to exploit the vulnerability.

One of the reasons we always encourage defence in depth!

share|improve this answer
If hypervisor is compromised, I'd rather call it damage control.. – pepe Jan 28 '12 at 11:01

Once a system is compromised you can not trust any of its services or processes. So with a hypervisor, you can not trust any of the VM's.

share|improve this answer

Look at it this way: a hypervisor is to its guests as hardware is to a normal operating system.

If a hacker has full access to your hardware you can no longer trust anything in your operating system. The same goes for a compromised hypervisor with respect to the guests.

share|improve this answer

All guest OSes can be affected.

This problem is very well explained in this presentation (from the 2008 RSA Conference).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.