Russian Security Expert leaked a critical Virtual Box Zero-day vulnerability online along with its exploit that allows an attacker to gain root/administrator privileges in a guest and escape to a host.
The vulnerability can be exploited from guest ring 3 level privilege which is used to exploit the most powerful hypervisor vulnerabilities that allow taking control over the host operating system.
Exploiting this Vulnerability that existing in the Virtual box is sophisticated and there is a lot more technical process involved in order to exploit and gain the host privilege.
Exploiting Algorithm Steps for Virtual Box Zero-day
Before executing the shellcode, researcher crossed the information leak, stack buffer overflow attacks in order to take control over the host.
Initially, attacker unloads the driver e1000.ko which is basically loaded in Linux guests by default and then load the  LKM exploits.
According to the datasheet, E1000 will be initialized by the Linux kernel module (LKM) to leak the information where LKM disables E1000 loopback mode to make stack buffer overflow code unreachable.
“Here The LKM uses the integer underflow vulnerability to make the heap buffer overflow. The heap buffer overflow allows for use E1000 EEPROM to write two any bytes relative to a heap buffer in 128 KB range. Hence the attacker gains a write primitive.”
Later to perform a stack overflow Researcher explained the following statement,
- The LKM enabled E1000 loopback mode to make stack buffer overflow code reachable.
- The LKM uses the integer underflow vulnerability to make the heap buffer overflow and the stack buffer overflow. Saved return address (RIP/EIP) is overwritten. The attacker gains control.
- ROP chain is executed to execute a shellcode loader.
Later the Shellcode loader copied the shellcode and executed it to perform an orbitary process on the host side.
Finally, The attacker unloads the LKM and loads e1000.ko back to allow the guest to use a network.
He explained a complete exploitation process in his GitHub Page and he released a test video as a proof of this Zero-day vulnerability.
In Above video, researcher loads the exploit in guest OS and the shell has been executed in host OS.
“Until the patched VirtualBox build is out you can change the network card of your virtual machines to PCnet (either of two) or to Paravirtualized Network. If you can’t, change the mode from NAT to another one. The former way is more secure”. Researcher said.
The Reasons why He made this Zero-day Vulnerability in Public
Before starting the complete exploitation details, he explained the following reasons to leak this Virtual box Zero-day Flaw online.
“I like VirtualBox and it has nothing to do with why I publish a 0day vulnerability. The reason is my disagreement with contemporary state of infosec, especially of security research and bug bounty:”
- Wait half a year until a vulnerability is patched is considered fine.
- In the bug bounty field these are considered fine:
- Wait more than month until a submitted vulnerability is verified and a decision to buy or not to buy is made.
- Change the decision on the fly. Today you figured out the bug bounty program will buy bugs in a software, week later you come with bugs and exploits and receive “not interested”.
- Have not a precise list of software a bug bounty is interested to buy bugs in. Handy for bug bounties, awkward for researchers.
- Have not precise lower and upper bounds of vulnerability prices. There are many things influencing a price but researchers need to know what is worth to work on and what is not.
3. The delusion of grandeur and marketing bullshit: naming vulnerabilities and creating websites for them; making a thousand conferences in a year; exaggerating importance of own job as a security researcher; considering yourself “a world saviour”. Come down, Your Highness.
I’m exhausted of the first two, therefore my move is full disclosure. Infosec, please move forward.
Please find the complete vulnerability & its exploit details Here.
Also Read:
Hackers Exploit Cisco Zero Day Vulnerability in Wild Resulting in DoS Condition
Hackers Exploit Cisco Zero Day Vulnerability in Wild Resulting in DoS Condition
Zero Day Attack Prevention: A Fundamental Pillar of Security
