How Likely Is It For A Virus To Spread From A Linux VM To The Windows Host

Question

I'm currently running Windows 10, and I plan to use a Linux distro to run in a VM (Virtual Box). I know Linux is one of the most secure operating systems there is and I'm curious as to how likely it is a virus could spread from the Linux distro onto my Windows. I've seen posts similar to this where answers usually mention a virus could still spread over a network, but I never saw Linux specifically mentioned. Does this still apply no matter the OS?

Edit: I am fully aware Linux still has holes and is still a target for malware. I only said one of the most secure because it's more secure than more widely-used operating systems like Windows.

Answer 1

Virtualization is designed to protect the host operating system (in your case windows) from the guest operating system (Linux). It's unlikely that a virus or malware running on a guest is going to spread directly to the host through the virtualization layer. The malware would have to be specifically designed to target the virtualization layer, and somehow break out of the VM. I'd never say this was impossible, but it seems an unlikely target given the complexity of accomplishing this.

More possible is malware using the guest machine as a base of operations to launch attacks on anything inside your network.

Answer 2

Depending on your setup between the host and the virtual guest there are a few ways that a worm or virus could propagate.

1) Simple networking. - If you have the networking adapter enabled on the virtual and the host can interact with it, then yes. A piece of malware that was multi-OS could propagate. Alternatively, if the malicious code was written in a cross-platform engine like Java, and you run Java on both the guest and host. This could be from setting the guest networking to host only, or host networking. Technically possible with any enabled networking, but more likely with those two. Nat and Bridged form the connection to the host's NIC differently.

2) Sharing enabled. - Having the host files or the clipboard even be writable to the guest can allow for an escape or evasion tactics. VMWare shared folders had at least one CVE published for escaping the guest via the shared folders function.. 2008-0923 when I searched it, but there might be more.

3) Driver based - Venom by crowdstrike showed how to do a Virtual escape based on the floppy driver being enabled by the guest. There may be similar vulnerabilities for other drivers.

Answer 3

Alter hardware host from wm

For my knowledge, there is now no way to alter a hardware node from a vw (container).

But I could be wrong, depending of wich virtualisation technology is used...

Spy hardware host from vm

Yes, it theorically be:

By analysing multi-cores CPU loads (or idle time) and/or temperature variations, a vm could spy what's going in parallels tasks (vm or host)...

• http://iss.oy.ne.ro/SpyInTheSandbox.pdf
• http://securityaffairs.co/wordpress/36178/hacking/spy-in-the-sandbox-attack.html

But if your Linux is correctly maintened, with strong password, security policy and up to date...

For my opinion I will prefer

to run Linux on Hardware node, (coreos or debian), and create at least two vm:

• Windows, by using KVM
• Linux, by using LXC

Easier to maintain, scale and backup, but this is only my opinion.

But this won't change theorical parallelisation risks on multi-cores CPUs.

Answer 4

Is it possible? Yes. One of the first Worms (a self-replicating piece of malware) was designed to work under the Unix system. And while Windows malware is certainly more prevalent, there are bad guys targeting Linux too. Remember that as soon as a piece of malware is on your system, it can download and run arbitrary code. So a Linux virus could certainly download a Windows virus and run it on another machine (whether it be the host VM or a remote machine).

How could it be done? Such an attack (from VM to host machine) would rely on a vulnerability in the virtualization layer. Such vulnerabilities have been seen; this CVE documents such case.