Exploit-DB #41932
Description: Oracle VirtualBox Guest Additions 5.1.18 - Unprivileged Windows User-Mode Guest Code Double-Free
Type: dos
Platform: multiple
Date: 2017-04-25
Author: Google Security Research

Exploit:
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1227

We have discovered a heap double-free vulnerability in the latest version of VirtualBox (5.1.18), with Guest Additions (and more specifically shared folders) enabled in the guest operating system. The heap memory corruption takes place in the VirtualBox.exe process running on a Windows host (other host platforms were untested). It can be triggered from an unprivileged ring-3 process running in a Windows guest, by performing two nt!NtQueryDirectoryFile system calls [1] against a shared (sub)directory one after another: the first one with the ReturnSingleEntry argument set to FALSE, and the next one with ReturnSingleEntry=TRUE. During the second system call, a double free takes place and the VM execution is aborted.

We have confirmed that the vulnerability reproduces with Windows 7/10 32-bit as the guest, and Windows 7 64-bit as the host system, but haven’t checked other configurations. However, it seems very likely that the specific version of Windows as the guest/host is irrelevant.

It also seems important for reproduction that the shared directory being queried has some files (preferably a few dozen) inside of it. The attached Proof of Concept program (written in C++, can be compiled with Microsoft Visual Studio) works by first creating a dedicated directory in the shared folder (called “vbox_crash”), and then creating 16 files with ~128 byte long names, which appears to be sufficient to always trigger the bug. Finally, it invokes the nt!NtQueryDirectoryFile syscall twice, leading to a VM crash. While the PoC requires write access to the shared folder to set up reliable conditions, it is probably not necessary in practical scenarios, as long as the shared folder already contains some files (which is most often the case).

If we assume that the shared folder is mounted as drive E, we can start the PoC as follows:

>VirtualBoxKiller.exe E:\

Immediately after pressing "enter", the virtual machine should be aborted. The last two lines of the VBoxHardening.log file corresponding to the VM should be similar to the following:

--- cut ---
  3e28.176c: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0xc0000374 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 4468037 ms, the end);
  1020.3404: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0xc0000374 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 4468638 ms, the end);
--- cut ---

The 0xc0000374 exit code above translates to STATUS_HEAP_CORRUPTION. A summary of the crash and the corresponding stack trace is as follows:

--- cut ---
  1: kd> g
  Critical error detected c0000374
  Break instruction exception - code 80000003 (first chance)
  ntdll!RtlReportCriticalFailure+0x2f:
  0033:00000000`76f3f22f cc              int     3

  1: kd> kb
  RetAddr           : Args to Child                                                           : Call Site
  00000000`76f3f846 : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000003 : ntdll!RtlReportCriticalFailure+0x2f
  00000000`76f40412 : 00000000`[PII_REDACTED]`03a50[PII_REDACTED]0`[PII_REDACTED]`00001000 : ntdll!RtlpReportHeapFailure+0x26
  00000000`76f42084 : 00000000`03a50[PII_REDACTED]0`05687df0 00000000`[PII_REDACTED]`038d0470 : ntdll!RtlpHeapHandleError+0x12
  00000000`76eda162 : 00000000`05687de0 00000000`[PII_REDACTED]`00[PII_REDACTED]07fe`efc8388b : ntdll!RtlpLogHeapFailure+0xa4
  00000000`76d81a0a : 00000000`[PII_REDACTED]`03f0e1b0 00000000`111fdd40 00000000`00000000 : ntdll!RtlFreeHeap+0x72
  00000000`725a8d94 : 00000000`00[PII_REDACTED]07fe`efc3919b 00000000`08edf[PII_REDACTED]0`05661c00 : kernel32!HeapFree+0xa
  000007fe`efc58fef : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`03f0e1b0 : MSVCR100!free+0x1c
  000007fe`f4613a96 : 00000000`05661d16 00000000`[PII_REDACTED]`[PII_REDACTED]`05687df0 : VBoxRT+0xc8fef
  000007fe`f4611a48 : 00000000`056676d0 00000000`08edf[PII_REDACTED]0`[PII_REDACTED]`05661c98 : VBoxSharedFolders!VBoxHGCMSvcLoad+0x1686
  000007fe`ee885c22 : 00000000`111fdd30 00000000`111fdd30 00000000`03f352b0 00000000`0000018c : VBoxSharedFolders+0x1a48
  000007fe`ee884a2c : 00000000`[PII_REDACTED]`111fdd30 00000000`[PII_REDACTED]`00000000 : VBoxC!VBoxDriversRegister+0x48c62
  000007fe`efc13b2f : 00000000`05747fe0 00000000`00000da4 00000000`[PII_REDACTED]`00000000 : VBoxC!VBoxDriversRegister+0x47a6c
  000007fe`efc91122 : 00000000`05737e90 00000000`05737e90 00000000`[PII_REDACTED]`00000000 : VBoxRT+0x83b2f
  00000000`72561d9f : 00000000`05737e90 00000000`[PII_REDACTED]`[PII_REDACTED]`00000000 : VBoxRT+0x101122
  00000000`72561e3b : 00000000`725f2ac0 00000000`05737e90 00000000`[PII_REDACTED]`00000000 : MSVCR100!endthreadex+0x43
  00000000`76d759bd : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : MSVCR100!endthreadex+0xdf
  00000000`76eaa2e1 : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : kernel32!BaseThreadInitThunk+0xd
  00000000`00000000 : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : ntdll!RtlUserThreadStart+0x1d
--- cut ---

When the "Heaps" option is enabled for VirtualBox.exe in Application Verifier, the crash is reported in the following way:

--- cut ---
  1: kd> g

  =======================================
  VERIFIER STOP [PII_REDACTED]: pid 0xC08: Heap block already freed. 

    000000000DCB1000 : Heap handle for the heap owning the block.
    000000001C37E000 : Heap block being freed again.
    [PII_REDACTED] : Size of the heap block.
    [PII_REDACTED] : Not used


  =======================================
  This verifier stop is not continuable. Process will be terminated 
  when you use the `go' debugger command.

  =======================================

  1: kd> kb
  RetAddr           : Args to Child                                                           : Call Site