KVM has a much larger attack surface than Xen