Virtualization Vulnerabilities Quiz

✅ Correct: B. A VM escape breaks the isolation boundary between a VM and the host (or other VMs). It is the most severe virtualization attack because the hypervisor manages many VMs on one physical host — escaping to the host gives access to all of them. Instead of compromising one VM, the attacker compromises the entire virtual infrastructure.

✅ Correct: C. The VMware hardware simulation bug was the final step. The Edge JS bug (A) achieved sandboxed code execution. The Windows 10 kernel bug (B) achieved guest OS compromise. Neither of these crossed the VM boundary — that required the VMware hardware simulation bug, which let code running in the compromised guest manipulate the hypervisor layer and escape to the host.

✅ Correct: B. Resource reuse is specifically about memory pages that are reclaimed from one VM and reassigned to another without being zeroed. If the hypervisor fails to zero the pages, residual data (credentials, keys, application state) from the first VM remains readable by the second. This is an information disclosure vulnerability — data leaks across VM isolation via shared physical memory.

✅ Correct: C. VM sprawl — the accumulation of unmanaged, orphaned VMs. The primary concerns are: (1) unpatched OS makes the VMs easy targets, (2) persistent firewall access to production segments means a compromised orphaned VM is a direct pivot point into production, and (3) no monitoring means compromise goes undetected. VM escape (A) and resource reuse (B) are different vulnerability types. Overcommitment (D) is a resource allocation concept, not a security vulnerability by itself.

✅ Correct: B. VMs run real OS instances — Windows, Linux, etc. — with the same vulnerabilities as their physical counterparts. The hypervisor does not patch guest OS vulnerabilities; it only enforces isolation between VMs. An unpatched Windows Server VM is just as vulnerable to OS exploits as an unpatched physical Windows Server. Option D is particularly dangerous — snapshot rollback is a recovery tool, not a security control, and using it after compromise may still leave data exposed.

✅ Correct: C. A hardware simulation bug in a hypervisor is exactly the type of vulnerability used in VM escape attacks (as demonstrated in Pwn2Own 2017). Delaying the patch a month keeps all 200 VMs exposed to an attack that, if successful, gives an attacker access to every VM on the host. Hypervisor patches for hardware simulation vulnerabilities should be treated as critical and applied on an emergency schedule — the brief interrupt of 200 VMs is far preferable to a potential full-host compromise. VM escape does not require physical access (D) — it is performed from inside a compromised VM over the network.

✅ Correct: B. VM isolation is a strong control and is effective against most threats — but it is not an absolute guarantee. The Pwn2Own 2017 demonstration showed that a real-world VM escape is achievable by chaining hypervisor vulnerabilities. Resource reuse vulnerabilities have also been demonstrated where data leaks between VMs via shared memory. The claim that a fully compromised VM poses "no risk" to others overstates the isolation guarantee. Proper cloud security requires defense-in-depth: patch hypervisors promptly, enable memory scrubbing, segment VM networks, and monitor for anomalous cross-VM activity.