Is it secure to enable KVM nested virtualization on our (physical) host in order to enable users to run own VMs inside their VPS? Or does it introduce some security issues to our primary host and nested virtualization should be used only for trusted VMs?

  • It's about as secure as using KVM in the first place. Some hypervisors don't nest as well within KVM. I've had multiple issues in the past when nesting ESXi under KVM in production, yet I've nested Xen and KVM under KVM with no problems.
    – Spooler
    Feb 6 '17 at 0:40

Virtualization always adds to security risk without something like shielded VMs. One of the immutable laws of security is " If a bad guy has unrestricted physical access to your computer, it's not your computer anymore" With respect to the VM layer if you have access to the host- you get access to the VM. Note that this applies to any cloud based service as well. If you have access to the management console- you effectively have access to the VM's running there and do as you please.

  • I mean from physical machine owner other side. If it's our physical server - can we enable nested virtualization on host? Or does it allow VPS user to escape to / destabilize physical host?
    – Lapsio
    Feb 5 '17 at 21:59
  • 2
    @user2111737 There's nothing inherent to nested virtualization that would allow such a scenario. Feb 5 '17 at 23:18
  • 1
    I agree, there are exploits in some hypervisors to gain privilege over the hypervisor, but I'm not sure you could double hop up to physical, and as mentioned, that's not inherent to nested virtualization per se.
    – Jim B
    Feb 6 '17 at 4:40

In short, there's a risk. VM's are less than perfect. Take a look at recent issues with xen.

http://seclists.org/oss-sec/2016/q4/684 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2596

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.