{"id":7622,"date":"2018-11-08T00:29:00","date_gmt":"2018-11-07T23:29:00","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=7622"},"modified":"2018-11-08T06:56:17","modified_gmt":"2018-11-08T05:56:17","slug":"virtualbox-exploit-for-0-day-vulnerability","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2018\/11\/08\/virtualbox-exploit-for-0-day-vulnerability\/","title":{"rendered":"VirtualBox: Exploit for 0-day vulnerability"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline;\" title=\"Virtualbox\" src=\"http:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2014\/04\/VBlogo.jpg\" alt=\"Virtualbox\" width=\"52\" height=\"55\" align=\"left\" \/>Bad news messages for users of the Oracle virtualization solution Virtualbox up to version 5.2.20. There is a 0-day vulnerability in the E1000 network component. Unfortunately, an exploit for this vulnerability has also become public. So if you use Virtualbox, you should react and adjust the network configuration.<\/p>\n<p><!--more--><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/vg08.met.vgwort.de\/na\/b2b87a96423444b8a207378ddfcc5bb5\" alt=\"\" width=\"1\" height=\"1\" \/>The person who has discovered of the vulnerability has published the <a href=\"https:\/\/github.com\/MorteNoir1\/virtualbox_e1000_0day\" target=\"_blank\" rel=\"noopener\">details on GitHub<\/a>. He is probably quite frustrated with how reported bugs are handled by Oracle. Therefore, he has decided to make full disclosure.<\/p>\n<h2>The vulnerarbility<\/h2>\n<p>There is an unpatched vulnerability in VirtualBox 5.2.20 (released on October 16, 2018) and earlier versions. This affects every host and guest operating system because the bug is in the shared code base.<\/p>\n<p>The 0-day vulnerability can be exploited, if an Intel PRO\/1000 MT Desktop (82540EM) network card is configured in the VM configuration in conjunction with the NAT network mode. This combination, referred to as E1000 in the GitHub article, has a vulnerability.<\/p>\n<p>The vulnerability allows an attacker with root\/administrator privileges on a guest system to break out of a guest system and enter the host string. Then the attacker can use existing techniques to increase privileges and reach ring 0 via \/dev\/vboxdrv.<\/p>\n<p>The attack scenario is described for interested blog readers in the Github post. However, it is usually sufficient to use the workaround described below and reconfigure the network interface to solve the problem.<\/p>\n<h2>Mitigating this vulnerability<\/h2>\n<p>Until a patched VirtualBox build is available, users can change the network card of a virtual machine to PCnet or Paravirtualized Network. If this is not possible, you should not use NAT mode.<\/p>\n<p><img decoding=\"async\" title=\"Virtualbox Netzwerk\" src=\"https:\/\/i.imgur.com\/bIN5GIJ.jpg\" alt=\"Virtualbox Netzwerk\" \/><\/p>\n<p>Details may be found at <a href=\"https:\/\/github.com\/MorteNoir1\/virtualbox_e1000_0day\" target=\"_blank\" rel=\"noopener\">GitHub<\/a> and at <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/virtualbox-zero-day-vulnerability-details-and-exploit-are-publicly-available\/\" target=\"_blank\" rel=\"noopener\">Bleeping Computer<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bad news messages for users of the Oracle virtualization solution Virtualbox up to version 5.2.20. There is a 0-day vulnerability in the E1000 network component. Unfortunately, an exploit for this vulnerability has also become public. So if you use Virtualbox, &hellip; <a href=\"https:\/\/borncity.com\/win\/2018\/11\/08\/virtualbox-exploit-for-0-day-vulnerability\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,1218],"tags":[69,939],"class_list":["post-7622","post","type-post","status-publish","format-standard","hentry","category-security","category-virtualization","tag-security","tag-virtualbox"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/7622","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=7622"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/7622\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=7622"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=7622"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=7622"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}