9 ms·
Oracle VM VirtualBox – VM Escape via VGA Device
- smegger001 1y agoWould this work with a headless VM only accessed via SSH? I naively perhaps assume it would be safe as its not using a virtual vga device but perhaps the machines still has the vga device present in the virtual environment it just not being used by the user but still vulnerable? also is this specific to any particular host operating system or all versions of virtualbox?
- bobmcnamara 1y agoAvailability of the VM device is up to the host's configuration for that VM. You can remove it, but there's one display present by default - don't recall which
- orev 1y agoAll* PCs require a VGA console to boot. Maybe there’s some special type that doesn’t, but it would be extremely rare. When running headless it’s just hiding the console window, but the device still exists on the machine.
- Retr0id 1y agoLinux has no problem booting without a VGA device present
- _flux 1y agoThat's true, but there may be some some desktop BIOSes that will fail to boot without a display adapter—though I've had good luck on that on the few hosts I've made headless servers.
- Retr0id 1y agoFortunately the BIOSes shipping in hypervisors tend to be more sane, and QEMU for example can direct-boot a linux kernel without even needing to emulate a BIOS/EFI first.
- da768 1y agoNetwork appliances (Lanner, Netgate, Axiomtek, PC Engines, etc) typically only have a serial console and no GPU hardware at all. Same applies for any linux VMs, you can remove VGA devices and keep a serial port in the config
- fulafel 1y agoDespite the title, the vulnerable function name (vmsvga3dSurfaceMipBufferSize) tells it's in the VMSVGA virtual 3D graphics device, not basic VGA hardware needed for normal bootup console stuff.
- rjsw 1y agoIf the kernel in the VM has the DRM code loaded into it, maybe as a module, then I think you would be able to trigger this bug.
- lyu07282 1y agoThe linked repo wasn't updated in 8 months, up-to-date code is here: https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Devices/Graphics/DevVGA-SVGA3d-shared.cpp#L332 https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Devic... I think this was the fix: https://www.virtualbox.org/changeset/108903/vbox/trunk/src/VBox/Devices/Graphics/DevVGA-SVGA3d-shared.cpp https://www.virtualbox.org/changeset/108903/vbox/trunk/src/V...
- johnisgood 1y agoThanks. Wild. I bet the codebase is full of code like the originally exploitable one. At this point maybe one should use wrappers for all sorts of calculations. :D
- vardump 1y agoVirtualBox just crashes all the time anyways. At least the few newest versions keep crashing when running Ubuntu 22.04 or 24.04 LTS.
- oguz-ismail 1y agoworks on my machine
- Neywiny 1y agoI updated to the latest (7.1.8?) and that fixed the inability to use 3d acceleration. But yes I've found they have a terrible release "process" that seems to not include testing. I tried switching to VMWare but A) broadcom makes it difficult to download B) since a recent kernel/driver update on my host, even a fresh Windows guest locks up in boot (can't get through install). Might try going back to qemu. VMWare had the best performance by far, though, which was great for windows only 3d model software. When with 3d acceleration Virtualbox is so sluggish for me.
- immibis 1y agoBroadcom is one of those companies that gets you hooked and then sues you for a lot of money. ... So is Oracle, though.
- vardump 1y agoI’m using the latest, same version. Just a horrible experience overall. Whole VirtualBox hypervisor crashes regularly. VMWare was the gold standard before, but so hopeless now. I wish Parallels released something for Windows. Their Mac offerings are great. Maybe I should try QEMU on the desktop as well.
- alyandon 1y agothey have a terrible release "process" that seems to not include testing I wouldn't say they have no testing process at all but it seems to me that they lack discipline when it comes to building releases and testing. I've seen releases that had debug-by-logging type code left in spamming the VM logs as well as breakage in what most would consider very common host + guest combinations. It's a shame that Oracle doesn't seem to care much about the overall quality of that product. I guess we should be happy Oracle cares enough to still develop it. :-/ Edit: And right now - VirtualBox is still not offering v7.1.8 inside the GUI app and there is no mention of this CVE in the 7.1.8 change logs.
- Thaxll 1y agoThere is no reason to use virtual box on Windows nowdays, Hyper-v and vmware are free for personnal use and are much much better than VirtualBox. https://blogs.vmware.com/workstation/2024/05/vmware-workstation-pro-now-available-free-for-personal-use.html https://blogs.vmware.com/workstation/2024/05/vmware-workstat...
- AshamedCaptain 1y agoVirtualBox is the only one of the 3 mentioned is still both free as in beer (even for commercial use*) as well as free as in freedom (GPLv3). * Unless you use the Oracle plugin, but you really shouldn't, because most features from it have been moved to the GPL base. The only other really free alternative is Qemu.
- notpushkin 1y ago> most features from it have been moved to the GPL base Wow, that’s nice to hear! Installing the ext pack used to be an almost mandatory step for me.
- TMWNN 1y ago> * Unless you use the Oracle plugin, but you really shouldn't, because most features from it have been moved to the GPL base. Oh? I moved to KVM via UnRAID, but not because of any particular complaint with VirtualBox or the Oracle plugin. But then, I only used the plugin for the RDP feature. Has that been moved into the main codebase?
- AshamedCaptain 1y agoNot RDP, but like encryption, it's the only other feature I can think of which remains on the extpack. IMHO they are all enterprisey "mark a checkbox" level features that should be irrelevant for even actual enterprise users. Why do you have to use RDP anyway? It gives almost zero advantages over VNC here since all the output is going to be raster.
- 1y ago
- AshamedCaptain 1y agoFor the record: Oracle does not consider that the 3D feature should be enabled when the VM is untrusted. It's still classified as experimental and will likely be so for another decade at least.
- fulafel 1y agoThey don't say anything about untrusted VMs or security in the documentation (https://www.virtualbox.org/manual/topics/guestadditions.html#guestadd-video https://www.virtualbox.org/manual/topics/guestadditions.html...).
- AshamedCaptain 1y agoIt does say it is experimental. In any case, my remark comes from my discussions with Oracle.
- westurner 1y agohttps://news.ycombinator.com/item?id=43067347 https://news.ycombinator.com/item?id=43067347 : > Still hoping for SR-IOV in retail GPUs. > Not sure about vCPU functionality in GPUs > Process isolation on vCPUs with or without SR-IOV is probably not as advanced as secure enclave approaches [Which just fell to post-spectre side channels] >> Is there sufficient process isolation in GPUs? /? Sr-iov iommu: https://www.google.com/search?q=sr-iov+iommu https://www.google.com/search?q=sr-iov+iommu Is there branch prediction in GPUs? What about other side channels between insufficiently-isolated GPU processes? I see that vgpu_unlock no longer works for technical reasons.
- deleted 1y ago[deleted]
- jawavvaa 1y agoI've seen something like this in ChromeOS too, since both devices will use similar methodologies and technologies in their respective VMs. The attackers would glitch the VGA framebuffer, and the only way you can tell was your screen would show random garbage briefly. As the attack escalated, the glitches got worse until either the computer crashed or they accomplished their exfiltration. I think ChromeOS patched it a while ago, so I don't see it anymore. Attack vector was something like Chrome Browser -> (?) -> Framebuffer -> [Cross VMs to host].
- snvzz 1y agoThis would not have been possible with seL4 virtualization. There, VM exceptions are turned into messages for VMM, which is unprivileged, and has capabilities that do not exceed those of the VM itself.