Unpatched VirtualBox Zero-Day Vulnerability and Exploit Released Online

An independent exploit developer and vulnerability researcher
has publicly disclosed a zero-day vulnerability in
VirtualBox—a popular open source virtualization software
developed by Oracle—that could allow a malicious program to escape
virtual machine (guest OS) and execute code on the operating system
of the host machine.

The vulnerability occurs due to memory corruption issues and
affects Intel PRO / 1000 MT Desktop (82540EM) network card (E1000)
when the network mode is set to NAT (Network Address
Translation).

The flaw is independent of the type of operating system being
used by the virtual and host machines because it resides in a
shared code base.

VirtualBox Zero-Day Exploit and Demo Video Released

Sergey Zelenyuk published Wednesday
a detailed technical explanation of the zero-day flaw on GitHub,
which affects all current versions (5.2.20 and prior) of
VirtualBox software and is present on the default Virtual Machine
(VM) configuration.
According to Zelenyuk, the vulnerability allows an attacker or a
malicious program with root or administrator rights in the guest OS
to escape and execute arbitrary code in the application layer (ring
3) of the host OS, which is used for running code from most user
programs with the least privileges.

Following successful exploitation, the researcher believes an
attacker can also obtain kernel privileges (ring 0) on the host
machine by exploiting other vulnerabilities.

Along with the details of the zero-day vulnerability, Zelenyuk also
wrote down the complete exploit chain and released a video
demonstration of the attack on Vimeo.

No Security Patch Yet Available, Here’s How to Protect
Yourself

The researcher claims his exploit is “100% reliable.”
Zelenyuk tested his exploit on Ubuntu version 16.04 and 18.04
x86-64 guests, but he believes the exploit also works against the
Windows platform.
While the exploit released by the researcher is not simple to
execute, full details of how to execute it are provided.

Zelenyuk decided to publicly disclose the zero-day vulnerability
and the exploit due to his “disagreement with [the] contemporary
state of infosec, especially of security research and bug bounty,”
which he experienced over a year ago when he responsibly reported
another VirtualBox flaw to Oracle.

The researcher also expressed his displeasure with the “delusion
of grandeur and marketing bullshit” with the vulnerability release
process by “naming vulnerabilities and creating websites for them,”
and security researchers putting themselves in front of “a thousand
conferences in a year.”

So, this time the researcher publicly disclosed the flaw, and
thus, there is no patch yet available.

However, until it is patched, users can protect themselves
against potential cyber attacks by changing the network card of
their “virtual machines to PCnet (either of two) or to
Paravirtualized Network.”

Though the researcher stressed that the above approach is more
secure, in case if you are unable to do that, you can change the
mode from NAT to another one.

^[1]