misc: Add threat model by DemiMarie · Pull Request #7875 · cloud-hypervisor/cloud-hypervisor

DemiMarie · 2026-03-22T06:51:22Z

This adds a security policy based on the Xen Project Security Policy.

alyssais

It is going to be fantastic to have this.

liuw · 2026-03-24T17:43:55Z

Who should be on the security team? What are the criteria for becoming a member of the security team?

likebreath

@DemiMarie Thank you for driving this effort.

Overall, I think we should split this PR and focus on the threat model for now — supported configurations and advisory handling should be separate follow-up PRs.

My main feedback on the threat model is around organization. The goal is to make the document structured enough to be easy to follow today and easy to maintain as Cloud Hypervisor evolves — when a new component is added, it should be clear where it fits and what security properties it needs.

Currently, vulnerability outcomes (privilege escalation, DoS, info leaks), attack surfaces (disk images, PCI, network/storage), and trust boundaries (guest userspace, vhost-user) are intermixed, which makes the document harder to navigate than it needs to be. One approach would be:

Trust boundaries — who is trusted and who isn't
Attack surfaces — what can attackers interact with
Security-relevant outcomes — what we consider a vulnerability (and not)

That said, this is just one option. Open to other ideas on how to best structure the threat model.

phip1611

I'm not very familiar with documents like this yet. However, it's probably a good idea to have one.
However, it's likely beneficial to have one in place. Thank you for your great work!

Left a few remarks

phip1611 · 2026-03-25T06:53:11Z

+
+### Privilege escalation (VM escape)
+
+Guest VMs running in Cloud Hypervisor are assumed untrusted.


very nit. line width seems to be pretty arbitrary here.

I personally limit all documents I write to a width of 80

phip1611 · 2026-03-25T06:54:19Z

+### Denial of service
+
+Cloud Hypervisor is a standalone executable, not a library,
+and only runs one guest throughout the entire lifetime


nit

nly runs one guest throughout the entire lifetime

strictly speaking it runs 0..=1 guest at any time, depending on the configuration

rbradford

I'm a bit confused - it seems to just have a threat model file and no security policy? e.g. how to handle potential issues.

phip1611

I'm more of an implementation-focused engineer than an expert in specifications or formal documents, so please feel free to ignore my comments if they are not useful. I can see how such a document might be beneficial, but I don’t have a strong opinion either way since this is not really my area of expertise.

phip1611 · 2026-04-20T11:28:05Z

+
+Cloud Hypervisor cannot protect itself or the host from hardware
+vulnerabilities. This is entirely the responsibility of the hardware, firmware,
+and Linux kernel. If Linux is running under another hypervisor (using nested


Suggested change

and Linux kernel. If Linux is running under another hypervisor (using nested

and the Linux kernel. If Linux is running under another hypervisor (using nested

phip1611 · 2026-04-20T11:31:51Z

+Cloud Hypervisor cannot protect itself or the host from hardware
+vulnerabilities. This is entirely the responsibility of the hardware, firmware,
+and Linux kernel. If Linux is running under another hypervisor (using nested
+virtualization), it is also the responsibility of that hypervisor.


If Linux is running under another hypervisor it is also the responsibility of that hypervisor.

I'd rewrite this to be more general or omit the nesting part entirely. You ALWAYS depend on the broader runtime environment executing your code. May it be silicon/physical hardware, emulation, nested virtualization or a potential future quantum computer. Also you could run under a Linux-like kernel.

phip1611 · 2026-04-20T11:33:04Z

+and Linux kernel. If Linux is running under another hypervisor (using nested
+virtualization), it is also the responsibility of that hypervisor.
+
+Cloud Hypervisor assumes that Linux is configured to prevent the guest


Cloud Hypervisor assumes that Linux is configured to prevent the guest
from reading or writing to memory belonging to the kernel or other userspace
processes.

this sounds like its a typical pitfall to misconfigure your linux. Instead, I'd say the environment must follow common best practices for proper isolation.

rbradford · 2026-05-11T15:20:50Z

This PR seems stuck? What's required to move forward with this? Is the scope too great?

DemiMarie · 2026-05-17T21:35:14Z

@rbradford It was blocked on the public disclosure of GHSA-f47p-p25q-83rh, as I want to include lessons learned from that.

This adds a threat model and security policy based on the Xen Project Security Policy. Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>

rbradford

Thank you for working on this!

rbradford · 2026-05-27T10:30:50Z

+
+Cloud Hypervisor does not protect itself from malicious callers.
+In particular, it is not safe to run Cloud Hypervisor SUID, SGID,
+or with Linux capabilities attached to its executable file.


Well, I think our instructions tell our user to set CAP_NET_ADMIN to create the tap device.

rbradford · 2026-05-27T10:32:09Z

+- An HTTP API.
+- A D-Bus API.
+- If backing files are enabled (they are disabled by default),
+  the name of the backing file of a qcow2 image.


It's not really controlled by this? Also if you're talking like that the guest can control the VMM via e.g. virtio-balloon having it punch holes, etc.

rbradford · 2026-05-27T10:33:39Z

+the guest it is running. The guest may cause Cloud Hypervisor to crash
+in a non-exploitable way, such as a Rust panic. Cloud Hypervisor assumes
+that a guest doing this only hurts itself.
+


A situation where userspace code can cause this to happen is something that we do consider an issue.

I will clarify that I mean guest kernel code.

rbradford · 2026-05-27T10:34:18Z

+It is not safe to use a userspace driver for a device provided by Cloud
+Hypervisor *except* on Arm64 with a virtio IOMMU. Even then, the
+userspace driver can still cause Cloud Hypervisor (and thus the guest)
+to crash.


I don't understand what this means?

The PCI emulation code is buggy and bad accesses can cause panics.

rbradford · 2026-05-27T10:36:25Z

+responsible for its contents and for filtering out false positives. As
+an exception, reports from Miri, Valgrind, or sanitizers can generally
+be assumed correct.


rbradford · 2026-05-27T10:37:52Z

+
+- Microsoft
+- Crusoe
+- Cyberus Technology


Meta

Google

UbiCloud

Do we really need to list them here - seems it would get stale quickly?

rbradford · 2026-06-12T12:14:14Z

Would someone like to take this over an reopen it?

DemiMarie · 2026-06-12T18:45:09Z

@rbradford me!

DemiMarie requested a review from a team as a code owner March 22, 2026 06:51

DemiMarie force-pushed the security branch 2 times, most recently from d7a6534 to 86c0caf Compare March 22, 2026 10:33

liuw reviewed Mar 23, 2026

View reviewed changes

Comment thread SECURITY.md Outdated

DemiMarie force-pushed the security branch from 86c0caf to 97ab45b Compare March 24, 2026 11:50

alyssais requested changes Mar 24, 2026

View reviewed changes

DemiMarie force-pushed the security branch from 97ab45b to 9ca28b9 Compare March 24, 2026 14:56

liuw reviewed Mar 24, 2026

View reviewed changes

Comment thread arch/src/lib.rs Outdated

likebreath reviewed Mar 24, 2026

View reviewed changes

likebreath requested review from phip1611, posk-io and rbradford March 24, 2026 23:20

phip1611 reviewed Mar 25, 2026

View reviewed changes

Comment thread arch/src/lib.rs Outdated

DemiMarie force-pushed the security branch 2 times, most recently from bb6c5e2 to 197f148 Compare March 25, 2026 11:58

posk-io reviewed Mar 25, 2026

View reviewed changes

Comment thread docs/threat-model.md Outdated

posk-io reviewed Mar 25, 2026

View reviewed changes

Comment thread docs/threat-model.md Outdated

posk-io reviewed Mar 25, 2026

View reviewed changes

Comment thread docs/threat-model.md Outdated

DemiMarie force-pushed the security branch from 197f148 to 1126548 Compare March 26, 2026 08:15

alyssais requested changes Mar 28, 2026

View reviewed changes

Comment thread docs/threat-model.md Outdated

Comment thread docs/threat-model.md Outdated

Comment thread docs/threat-model.md Outdated

rbradford requested changes Apr 14, 2026

View reviewed changes

rbradford marked this pull request as draft April 16, 2026 16:46

rbradford changed the title ~~misc: Add security policy~~ misc: Add thread model Apr 16, 2026

rbradford changed the title ~~misc: Add thread model~~ misc: Add threat model Apr 16, 2026

phip1611 reviewed Apr 20, 2026

View reviewed changes

DemiMarie force-pushed the security branch from c0aacf2 to b13dbcb Compare May 18, 2026 07:42

DemiMarie force-pushed the security branch from b13dbcb to 13ec5e6 Compare May 18, 2026 07:56

rbradford reviewed May 18, 2026

View reviewed changes

Comment thread SECURITY.md Outdated

DemiMarie force-pushed the security branch from 13ec5e6 to 552d27c Compare May 18, 2026 12:32

misc: Add security policy

9a271ef

This adds a threat model and security policy based on the Xen Project Security Policy. Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>

DemiMarie force-pushed the security branch from 552d27c to 9a271ef Compare May 26, 2026 05:58

rbradford reviewed May 27, 2026

View reviewed changes

rbradford closed this Jun 12, 2026

DemiMarie mentioned this pull request Jun 13, 2026

misc: Add security policy #8384

Open


		### Privilege escalation (VM escape)

		Guest VMs running in Cloud Hypervisor are assumed untrusted.

	and Linux kernel. If Linux is running under another hypervisor (using nested
	and the Linux kernel. If Linux is running under another hypervisor (using nested

Conversation

DemiMarie commented Mar 22, 2026

Uh oh!

Uh oh!

alyssais left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

liuw commented Mar 24, 2026

Uh oh!

Uh oh!

likebreath left a comment

Choose a reason for hiding this comment

Uh oh!

phip1611 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rbradford left a comment

Choose a reason for hiding this comment

Uh oh!

phip1611 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rbradford commented May 11, 2026

Uh oh!

DemiMarie commented May 17, 2026

Uh oh!

Uh oh!

rbradford left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment