Question about Virtual Machines w/o network access

I was wondering how vulnerable are virtual machines that are in a "host-only" setup? The host os can communicate to the guest os.

Are these systems susceptible to certain attacks? Do unpatched host systems in this configuration pose the same threat as an unpatched guest os?

 

Good question. I don't know if anyone has done extensive analysis of this. The most obvious thing to do is turn off sharing between the guest and host. I use Virtualbox and as a matter of convenience it is possible to share folders between the two in order to move files back and forth. If you really need to isolate the guest, for instance if you're using it to run malware and test security apps, then this "sharing" is dangerous.

As to "patching" it makes sense to fully patch both the guest and host. Why would you leave either unpatched? No doubt there are undiscovered attack vectors. There are folks here that do use VMs to test malware - they would be the best ones to ask for more info.