KernelSnitch in a VM

[zvonkok]

Great paper!
Have you guys done any experiments running KernelSnitch in a VM, and how can it be used to escape a VMM like QEMU?
Or how KernelSnitch could be used to attack confidential VMs?

[lukasmaar]

Thanks.
The basic principle of KernelSnitch is that the victim and attacker must share the same kernel. So in its current form, KernelSnitch cannot be used to attack VMs. However, KernelSnitch can be extended to attack VMs if you find a data structure in, say, the KVM subsystem that has measurable timing differences based on its state.