From my understanding:

  1. I can emulate many different architectures and systems with qemu as a user(mode) process.
  2. There is separate user address space per process.
  3. If a malicious process were to escape emulation it could compromise the user of the process and then get root from there.
  4. Due to the high privileges needed for hardware virtualization, if a malicious process were to escape hardware virtualization the process would usually be able to directly get root.
  5. For hardware virtualization if there was a flaw in the hardware (implementation of Intel VT/AMD-V) a malicious process in a guest would have an easier time to exploit the hardware flaw than if it were in an emulated environment.
  6. Paravirtualization/direct hardware access to other resources increases risks, but not relevant to the general question here.

Is this right? Does this make emulation/software virtualization more secure/isolated than hardware virtualization?

  • 1
    Does this answer your question? Is Docker more secure than VMs or bare metal? This question addresses Docker, but the answer is applicable to all OS virtualization solutions.
    – mentallurg
    Commented Feb 16 at 4:27
  • I don't feel it really addresses the isolation portion in regards to system emulation vs hardware virtualization. Additionally while two emulation processes may be sharing a kernel without hardware arbitrating there is a kernel within each emulation that has to be broken(through). I was kind of wanting to get input more of the layer between emulated kernel and host running user process.
    – ift-436t
    Commented Feb 16 at 5:07
  • The linked answer shows cases, when OS vulnerabilities allow attack on OS and on other containers. Where as the same vulnerabilities in the OS within VM have no any effect on the hosts system. Thus, the inked answer shows that a VM is more secure than a container.
    – mentallurg
    Commented Feb 16 at 6:26
  • Yes I know, but system emulation isn't a container and has different layers.
    – ift-436t
    Commented Feb 16 at 14:31

3 Answers 3


I don't think that one call one more secure than the other. These different isolations work at different parts of a system and have different duties. Trying to compare their inherent security by ignoring the context they are used in is like comparing the security of a ship with that of a car - one can try this but the conclusions are likely not helpful.

What is referred to as "hardware isolation" is in practice more a hardware-assisted software isolation anyway, i.e. different CPU rings are used to isolate hypervisor, kernel and user space and restrict interaction to clearly defined path, CPU/MMU based memory separation is used to separate memory of processes inside the OS ...

And it is not that one get the same isolation properties as hardware provides simply in software. If one has no hardware assisted memory isolation but instead only flat memory where every process can access everything, then it is really hard to build a robust memory isolation on top of this. And it will likely be slow too, which makes it unusable.


This is often used to run legacy software on modern hardware. In terms of isolation and security, emulation can provide a high degree of isolation because it creates a virtual environment that is completely separate from the host system.

However, the security of the emulation depends on the accuracy of the emulation software. If there are any vulnerabilities in the emulation software, they could potentially be exploited to gain access to the host system.

Software virtualization can provide a high degree of isolation and security, but it is still vulnerable to certain types of attacks, such as side-channel attacks.

Hardware virtualization, also known as hardware-assisted virtualization, involves using special hardware features, such as Intel VT-x or AMD-V, to improve the performance and security of virtualization.

Hardware virtualization can provide a higher degree of isolation and security than software virtualization because it offloads some virtualization tasks to the hardware, which is typically more secure than software. However, hardware virtualization is still vulnerable to certain types of attacks, such as hypervisor attacks.

  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Feb 19 at 21:12

From a practical PoV we have popular consumer virtualization applications such as VMWare Workstation and VirtualBox and both have had security issues no matter whether they provided software or hardware virtualization. The latter is a relatively recent thing.

If you need absolute security, you run the software that you cannot trust on a separate computer which is isolated from your network. There's no other way.

There is a black market for yet to be unearthed software vulnerabilities and exploits against hypervisors are a very hot topic, so if someone has targeted you specifically they have a chance to escape virtualization and compromise your system regardless.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .