sudo journalctl -u serial-getty@ttyS0.service
if serial-console-enable is installed, which results in kernel parameter console=ttyS0 being set, but no (virtual) serial console has been added, this results in errors in journal.
Jan 03 05:34:22 localhost systemd[1]: Started serial-getty@ttyS0.service - Serial Getty on ttyS0.
Jan 03 05:34:22 localhost (agetty)[1431]: serial-getty@ttyS0.service: Failed to set up standard input: Input/output error
Jan 03 05:34:22 localhost (agetty)[1431]: serial-getty@ttyS0.service: Failed at step STDIN spawning /sbin/agetty: Input/output error
Jan 03 05:34:22 localhost systemd[1]: serial-getty@ttyS0.service: Deactivated successfully.
Jan 03 05:34:22 localhost systemd[1]: serial-getty@ttyS0.service: Scheduled restart job, restart counter is at 5.
Jan 03 05:34:22 localhost systemd[1]: Stopped serial-getty@ttyS0.service - Serial Getty on ttyS0.
Therefore serial-console-enable should probably not be installed by default.
Unless VMs had a serial console by default but I haven’t researched yet if that would increase the attack surface.