A hypervisor is software that creates and runs virtual machines, sharing a physical computer’s CPU, memory and devices among several isolated guest operating systems.
How hypervisors work
The hypervisor, also called a virtual machine monitor (VMM), sits between the hardware and the guest systems and enforces their isolation. There are two main types:
- Type 1 (bare-metal) – runs directly on the hardware, for example VMware ESXi, Microsoft Hyper-V, Xen and KVM. This is the standard in data centres and clouds.
- Type 2 (hosted) – runs as an application on a normal operating system, such as Oracle VirtualBox or VMware Workstation, and is typical for desktops and labs.
Hypervisors are also a security building block: Windows virtualization-based security uses Hyper-V to protect credentials and kernel integrity even from code running in the main OS.
Why hypervisors matter for security
A single hypervisor may run dozens of virtual machines, so compromising it gives control over all of them.
- Ransomware on ESXi – groups such as LockBit, BlackCat and Akira released Linux versions of their ransomware that encrypt VM disk files directly on ESXi hosts. In February 2023 the ESXiArgs campaign hit thousands of unpatched internet-facing ESXi servers via an old OpenSLP flaw.
- VM escape – a sandbox escape from a guest into the hypervisor breaks the isolation that cloud providers rely on; such bugs are among the most valuable at hacking contests like Pwn2Own.
- Hyperjacking – malware that installs a malicious hypervisor beneath the operating system, an idea demonstrated by Joanna Rutkowska’s Blue Pill rootkit concept in 2006.
How to protect hypervisors
- Patch hypervisors quickly and never expose management interfaces to the internet.
- Separate hypervisor administration from the normal Active Directory and use MFA.
- Enable lockdown modes and disable unused services such as SSH and SLP.
- Keep offline or immutable backups of virtual machines.
Synonyms:
virtual machine monitor
