Exploit-DB #32208
Description: Oracle VM VirtualBox - 3D Acceleration Multiple Vulnerabilities
Type: dos
Platform: multiple
Date: 2014-03-12
Author: Core Security

Exploit:
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities



1. *Advisory Information*

Title: Oracle VirtualBox 3D Acceleration Multiple Memory Corruption
Vulnerabilities
Advisory ID: CORE-2014-0002
Advisory URL:
http://www.coresecurity.com/content/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities
Date published: 2014-03-11
Date of last update: 2014-03-11
Vendors contacted: Oracle
Release mode: User release



2. *Vulnerability Information*

Class: Improper Validation of Array Index [CWE-129], Improper Validation
of Array Index [CWE-129], Improper Validation of Array Index [CWE-129]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2014-0981, CVE-2014-0982, CVE-2014-0983



3. *Vulnerability Description*

VirtualBox is a general-purpose full virtualizer for x86 hardware,
targeted at server, desktop and embedded use.

VirtualBox provides -among many other features- 3D Acceleration for
guest machines
through its Guest Additions. This feature allows guest machines to use
the host machine's
GPU to render 3D graphics based on then OpenGL or Direct3D APIs.

Multiple memory corruption vulnerabilities have been found in the code
that implements
3D Acceleration for OpenGL graphics in Oracle VirtualBox.
These vulnerabilities could allow an attacker who is already running
code within
a Guest OS to escape from the virtual machine and execute arbitrary code
on the Host OS.


4. *Vulnerable packages*

   . Oracle VirtualBox v4.2.20 and earlier.
   . Oracle VirtualBox v4.3.6 and earlier.
   . Other versions may be affected too but they were no checked.

5. *Non-vulnerable packages*

   . Oracle VirtualBox v4.3.8.

6. *Credits*

This vulnerability was discovered and researched by Francisco Falcon from
Core Exploit Writers Team. The publication of this advisory was coordinated
by Andres Blanco from Core Advisories Team.



7. *Technical Description / Proof of Concept Code*

VirtualBox makes use of the *Chromium*[1] open-source library
(not to be confused with the open-source web browser) in order to
provide 3D Acceleration for OpenGL graphics.

Chromium provides remote rendering of OpenGL graphics through a
client/server model, in which
a client (i.e. an OpenGL application) delegates the rendering to the
server, which has access
to 3D-capable hardware.

When 3D Acceleration is enabled in VirtualBox, OpenGL apps running
within a Guest OS
(acting as Chromium clients) will send rendering commands to the
Chromium server, which is
running in the context of the hypervisor in the Host OS.

The code that handles OpenGL rendering commands on the Host side is
prone to multiple memory
corruption vulnerabilities, as described below.


7.1. *VirtualBox crNetRecvReadback Memory Corruption Vulnerability*

[CVE-2014-0981] The first vulnerability is caused by a *design flaw* in
Chromium. The Chromium server makes use
of "*network pointers*". As defined in Chromium's documentation,
'"Network pointers are
simply memory addresses that reside on another machine.[...] The
networking layer will then
take care of writing the payload data to the specified address."'[2]

So the Chromium's server code, which runs in the context of the
VirtualBox hypervisor
in the Host OS, provides a write-what-where memory corruption primitive
*by design*, which
can be exploited to corrupt arbitrary memory addresses with arbitrary
data in the hypervisor process
from within a virtual machine.

This is the code of the vulnerable function [file
'src/VBox/GuestHost/OpenGL/util/net.c'], which can
be reached by sending a 'CR_MESSAGE_READBACK' message to the
'VBoxSharedCrOpenGL' service:


/-----
/**
 * Called by the main receive function when we get a CR_MESSAGE_READBACK
 * message.  Used to implement glGet*() functions.
 */
static void
crNetRecvReadback( CRMessageReadback *rb, unsigned int len )
{
    /* minus the header, the destination pointer,
     * *and* the implicit writeback pointer at the head. */

    int payload_len = len - sizeof( *rb );
    int *writeback;
    void *dest_ptr;
    crMemcpy( &writeback, &(rb->writeback_ptr), sizeof( writeback ) );
    crMemcpy( &dest_ptr, &(rb->readback_ptr), sizeof( dest_ptr ) );

    (*writeback)--;
    crMemcpy( dest_ptr, ((char *)rb) + sizeof(*rb), payload_len );
}

     
-----/

Note that 'rb' points to a 'CRMessageReadback' structure, which is fully
controlled by the
application running inside a VM that is sending OpenGL rendering
commands to the Host side.
The 'len' parameter is also fully controlled from the Guest side, so
it's possible to:

   1. decrement the value stored at any memory address within the
address space of the hypervisor.
   2. write any data to any memory address within the address space of
the hypervisor.

7.2. *VirtualBox crNetRecvWriteback Memory Corruption Vulnerability*

[CVE-2014-0982] The second vulnerability is closely related to the first
one, and it's also caused by Chromium's
"*network pointers*".

This is the code of the vulnerable function [file
'src/VBox/GuestHost/OpenGL/util/net.c'], which can
be reached by sending a 'CR_MESSAGE_WRITEBACK' message to the
'VBoxSharedCrOpenGL' service:


/-----
/**
 * Called by the main receive function when we get a CR_MESSAGE_WRITEBACK
 * message.  Writeback is used to implement glGet*() functions.
 */
static void
crNetRecvWriteback( CRMessageWriteback *wb )
{
    int *writeback;
    crMemcpy( &writeback, &(wb->writeback_ptr), sizeof( writeback ) );
    (*writeback)--;
}
     
-----/

Note that 'rb' points to a 'CRMessageWriteback' structure, which is
fully controlled by the
application running inside a VM that is sending OpenGL rendering
commands to the Host side, so it's possible to
decrement the value