{"id":13153,"date":"2018-08-20T14:19:06","date_gmt":"2018-08-20T22:19:06","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/08\/20\/news-6920\/"},"modified":"2018-08-20T14:19:06","modified_gmt":"2018-08-20T22:19:06","slug":"news-6920","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/08\/20\/news-6920\/","title":{"rendered":"SSD Advisory \u2013 VirtualBox VRDP Guest-to-Host Escape"},"content":{"rendered":"

Credit to Author: SSD \/ Ori Nimron| Date: Mon, 20 Aug 2018 06:00:52 +0000<\/strong><\/p>\n

\n
\n

Vulnerability Summary<\/strong>
VirtualBox has a built-in RDP server which provides access to a guest machine. While the RDP client sees the guest OS, the RDP server runs on the host OS. Therefore, to view the guest OS the RDP client will make a connection to the host OS IP address rather than the guest OS IP address.<\/p>\n

The VRDP server is composted of two parts: a high level, which is open source and residing in the VirtualBox source tree, and is responsible for the display management, and a low level shipped with Extension Pack which is the RDP server which conforms to RDP specifications.<\/p>\n

The vulnerability is in the high level part. The vulnerability can be triggered when a connection to a Windows guest OS is closed, i.e. when we close the window of the RDP client application like rdesktop or Microsoft Remote Desktop.<\/p>\n

While the crashing bug was reported to the VirtualBox tracker (https:\/\/www.virtualbox.org\/ticket\/16444), it was never considered a security vulnerability, and is not marked as one. This ticket is 15 months old at the time of writing this post and still marked as unresolved.<\/p>\n

Prerequisites to exploit the vulnerability:<\/p>\n

    \n
  • VirtualBox Extension Pack installed on a host. It’s required to enable VRDP server<\/li>\n
  • VRDP server enabled<\/li>\n
  • 3D acceleration enabled<\/li>\n
  • Windows 10 as a guest<\/li>\n<\/ul>\n

    The vulnerability can probably be triggered from other guest OS due to the fact the the vulnerable code resides inside the Guest Additions driver.<\/p>\n

    Credit<\/strong>
    An independent security researcher, Sergey\u00a0Zelenyuk, has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.
    <\/span>
    Affected systems<\/strong>
    VirtualBox version 5.2.10<\/p>\n

    Vendor response<\/strong>
    We reported this vulnerability to Oracle, the latest update from them is that they are still looking into it, while in fact the latest version of Oracle VirtualBox version 5.2.18 has silently introduced a patch without giving credit or mentioning of the vulnerability report. We do not know at this time if this fix was intentional (to fix our report) or done for some other reason, the change log does mention: “VRDP: fixed VM process termination on RDP client disconnect if 3D is enabled for the virtual machine”.<\/p>\n

    Vulnerability Analysis<\/b>
    General analysis<\/i>
    The vulnerability consists of two parts: a type confusion and a UAF. It’s not clear which of them is a bug and which one was the developer’s intention. We will discuss them separately later in subsection Root Cause Analysis.<\/p>\n

    Starting from the end, when RDP connection is being closed we gain control at the following place in \/VirtualBox-5.2.8\/src\/VBox\/Main\/src-client\/ConsoleVRDPServer.cpp file, line 1994:<\/p>\n

    \t\t<\/p>\n

    \n
    <\/span> \t\t\t<\/p>\n
    \n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n
    <\/div>\n