VM escape vulnerabilities patched in VirtualBox (techrepublic.com)

Thanks. The article didn't say when the vulnerabilities were discovered. Depending who discovered them, it could have been months or more. I brought it up to clarify that these aren't unpatched vulnerabilities.

Huh. Next thing you know Microsoft is going to host all Windows and Office development on public github repos, IBM begins lobbying against software patents, and GNU/Hurd reaches 1.0... These are interesting times we live in for sure.

    Patent Troll: Hi, I am a Patent Troll, 
                  and I want to sue your ... company.
    Halliburton:  Look, Dame or Dude, you have three choices: 
                  1. We have a patent on that. 
                     You cannot sue us without a license. 
                     Good bye!
                  2. We have a patent on that. 
                     You cannot sue us without a license.
                     Licenses are $ 42 trillion.
                     *Per Lawyer*.
                     See you in court. Or not.
                  3. We buy your company, because we rule!
    Patent Troll: *Head explodes*
    
    -- The End --

That was already closed at Sun times I believe since it contains third party code where Sun/Oracle didn't have the right to open source it.

In past I wanted my employers to pay for VirtualBox commercial licences (to support the project and in some cases it was a requirement that all software used in development process is properly licensed) but I couldn't even find it anywhere as a product. Nowadays it is available[1] (not sure since when) but minimum number of licenses to purchase is 100.

[1]: https://shop.oracle.com/apex/product?p1=OracleVMVirtualBoxEn...

Xen doesn't: https://www.cvedetails.com/vulnerability-list/vendor_id-6276...

> Microsoft Virtual PC still exists

Not updated in almost 10 years, not supported on Windows 8 or 10.

> I am not sure, however, if it comes with the client editions of Windows. Microsoft Virtual PC still exists, too.

It's in Windows 10 client editions too. Look under "Turn Windows features on or off". Windows Subsystem for Linux is there too.

There is no particular reason to expect that qemu has any greater security that vbox. All of these systems have a significant amount of very critical code; I particularly sceptical of the hardware emulation part.

AWS recently started moving from a custom Xen to a custom KVM, but it doesn't seem it was for security reasons. Xen certainly is heavily used by public cloud providers.

Virtualization capable hardware required though (I don't know about Hyper-V).

Judging by the descriptions, these VirtualBox bugs are all in the device emulation, host-to-guest communications framework and so on, so they would apply equally whether the VM was using virtualization hardware or instruction emulation. This isn't unique to VirtualBox's track record -- the 'attack surface' for a VM is almost entirely in the device models, where software bugs allow VM escapes. The hardware virtualization is much less likely to cause problems: CPU bugs are rare compared to software bugs. In fact I think a pure-emulation setup would be worse off, because there's a lot more potentially buggy software doing the emulation that the guest can try to exploit. If you don't see those in a CVE list it's because nobody's bothering to try to exploit whatever emulator you're using, or because the emulator doesn't promise guest isolation and doesn't track bugs as CVEs. Comparison of raw CVE counts is tricky and risks apples-to-oranges problems.