Does emulation/software virtualization provide more isolation/security vs hardware virtualization?

Question

From my understanding:

1. I can emulate many different architectures and systems with qemu as a user(mode) process.
2. There is separate user address space per process.
3. If a malicious process were to escape emulation it could compromise the user of the process and then get root from there.
4. Due to the high privileges needed for hardware virtualization, if a malicious process were to escape hardware virtualization the process would usually be able to directly get root.
5. For hardware virtualization if there was a flaw in the hardware (implementation of Intel VT/AMD-V) a malicious process in a guest would have an easier time to exploit the hardware flaw than if it were in an emulated environment.
6. Paravirtualization/direct hardware access to other resources increases risks, but not relevant to the general question here.

Is this right? Does this make emulation/software virtualization more secure/isolated than hardware virtualization?

Answer 1

I don't think that one call one more secure than the other. These different isolations work at different parts of a system and have different duties. Trying to compare their inherent security by ignoring the context they are used in is like comparing the security of a ship with that of a car - one can try this but the conclusions are likely not helpful.

What is referred to as "hardware isolation" is in practice more a hardware-assisted software isolation anyway, i.e. different CPU rings are used to isolate hypervisor, kernel and user space and restrict interaction to clearly defined path, CPU/MMU based memory separation is used to separate memory of processes inside the OS ...

And it is not that one get the same isolation properties as hardware provides simply in software. If one has no hardware assisted memory isolation but instead only flat memory where every process can access everything, then it is really hard to build a robust memory isolation on top of this. And it will likely be slow too, which makes it unusable.

Answer 2

This is often used to run legacy software on modern hardware. In terms of isolation and security, emulation can provide a high degree of isolation because it creates a virtual environment that is completely separate from the host system.

However, the security of the emulation depends on the accuracy of the emulation software. If there are any vulnerabilities in the emulation software, they could potentially be exploited to gain access to the host system.

Software virtualization can provide a high degree of isolation and security, but it is still vulnerable to certain types of attacks, such as side-channel attacks.

Hardware virtualization, also known as hardware-assisted virtualization, involves using special hardware features, such as Intel VT-x or AMD-V, to improve the performance and security of virtualization.

Hardware virtualization can provide a higher degree of isolation and security than software virtualization because it offloads some virtualization tasks to the hardware, which is typically more secure than software. However, hardware virtualization is still vulnerable to certain types of attacks, such as hypervisor attacks.

Answer 3

From a practical PoV we have popular consumer virtualization applications such as VMWare Workstation and VirtualBox and both have had security issues no matter whether they provided software or hardware virtualization. The latter is a relatively recent thing.

If you need absolute security, you run the software that you cannot trust on a separate computer which is isolated from your network. There's no other way.

There is a black market for yet to be unearthed software vulnerabilities and exploits against hypervisors are a very hot topic, so if someone has targeted you specifically they have a chance to escape virtualization and compromise your system regardless.