&gt; Why any replacement for the libc would contain less vulnerability?<p>Because it would be written in better languages.<p>&gt; Same question for replacing a kernel with an &quot;hypervisor&quot;.<p>Because the hypervisor implements a much smaller, better specified API than a kernel does.