VirtualBox Zero-Day Released

A zero-day vulnerability has been identified in VirtualBox that can be exploited to allow malware to escape from the virtual machine guest to the host machine. The security researcher Sergey Zelenyuk publicly released his findings on November 6th without notifying VirtualBox, meaning that no security patch is available at the time of publishing. Temporary mitigation measures were also released by Sergey (see What you should do about it).

At this time, successful exploitation requires advanced technical skills to develop and chain together with additional privilege escalation exploits. This vulnerability does not affect type-1 hypervisors, meaning cloud environments are not impacted. For these reasons, widespread adoption/exploitation is not expected in the near term.

What we’re doing about it

• The eSentire Threat Intelligence Team is monitoring this issue for additional information
• For eSentire customers with esRECON plugins will be updated as they become available to assist in identifying and remediating this zero-day vulnerability

What you should do about it

• Apply security patches once they are made available
• Until patch release: Modify the standard VirtualBox configuration by changing the network card from Intel PRO/1000 MT Desktop (82540EM) to PCnet or Paravirtualized Network, or change the network mode from NAT

Additional information

Virtual machines (VMs) are the emulation of an operating system, which allows users to have multiple separate operating systems on one physical device. Escaping the sandbox refers to malware that is opened on the virtual machine, circumventing security and affecting the underlying operating system. Virtual systems are made to be separate from the underlying system and are often used for malware analysis if escape is possible the threat actor gains access to more information story on the host machine and there is a higher chance of lateral movement to additional machines.

This zero-day vulnerability only affects type-two hypervisor of VirtualBox virtual machines. Type-two hypervisors are generally used for desktop machines, meaning that cloud environments are not affected. Sergey chose to release this vulnerability without notifying VirtualBox due to disagreements with the handling of vulnerability reporting and bug bounties; notably, the amount of time that passes before companies action the reported issue [1].

References:

[1] GitHub: MorteNoir1/virtualbox_e1000_0day VirtualBox E1000 Guest-to-Host Escape
https://github.com/MorteNoir1/virtualbox_e1000_0day