SB2018110701 - Privilege escalation in Oracle Virtualbox

Description

This security bulletin contains information about 1 security vulnerability.

1) Privilege escalation (CVE-ID: N/A)

The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.

The weakness exists in a shared code base of the virtualization software on virtual machines configured with the Intel PRO/1000 MT Desktop (82540EM) network adapter in Network Address Translation (NAT) mode due to default setup that may lead to multiple boundary errors. An adjacent attacker can trigger an integer underflow condition using packet descriptors - data segments that allow the network adapter to track network packet data in the system memory, to read data from the guest OS to cause heap-based buffer overflow that may lead to overwriting function pointers; or to cause a stack overflow condition. 

Successful exploitation of the vulnerability allows an adjacent attacker with root/administrator privileges to escape the virtual environment of the guest machine and reach the Ring 3 privilege layer to escalate privileges to ring 0 via /dev/vboxdrv.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://github.com/MorteNoir1/virtualbox_e1000_0day