An independent exploit developer and vulnerability researcher has publicly disclosed a zero-day vulnerability in VirtualBox—a popular open source virtualization software developed by Oracle—that could allow a malicious program to escape virtual machine (guest OS) and execute code on the operating system of the host machine.

The vulnerability occurs due to memory corruption issues and affects Intel PRO / 1000 MT Desktop (82540EM) network card (E1000) when the network mode is set to NAT (Network Address Translation).

The flaw is independent of the type of operating system being used by the virtual and host machines because it resides in a shared code base.

VirtualBox Zero-Day Exploit and Demo Video Released

Sergey Zelenyuk published Wednesday a detailed technical explanation of the zero-day flaw on GitHub, which affects all current versions (5.2.20 and prior) of VirtualBox software and is present on the default Virtual Machine (VM) configuration.

According to Zelenyuk, the vulnerability allows an attacker or a malicious program with root or administrator rights in the guest OS to escape and execute arbitrary code in the application layer (ring 3) of the host OS, which is used for running code from most user programs with the least privileges.
Following successful exploitation, the researcher believes an attacker can also obtain kernel privileges (ring 0) on the host machine by exploiting other vulnerabilities.

"The E1000 has a vulnerability allowing an attacker with root/administrator privileges in a guest to escape to a host ring 3. Then the attacker can use existing techniques to escalate privileges to ring 0 via /dev/vboxdrv," Zelenyuk said.

Along with the details of the zero-day vulnerability, Zelenyuk also wrote down the complete exploit chain and released a video demonstration of the attack on Vimeo.

No Security Patch Yet Available, Here's How to Protect Yourself

The researcher claims his exploit is "100% reliable." Zelenyuk tested his exploit on Ubuntu version 16.04 and 18.04 x86-64 guests, but he believes the exploit also works against the Windows platform.

While the exploit released by the researcher is not simple to execute, full details of how to execute it are provided.

Zelenyuk decided to publicly disclose the zero-day vulnerability and the exploit due to his "disagreement with [the] contemporary state of infosec, especially of security research and bug bounty," which he experienced over a year ago when he responsibly reported another VirtualBox flaw to Oracle.

The researcher also expressed his displeasure with the "delusion of grandeur and marketing bullshit" with the vulnerability release process by "naming vulnerabilities and creating websites for them," and security researchers putting themselves in front of "a thousand conferences in a year."

So, this time the researcher publicly disclosed the flaw, and thus, there is no patch yet available.

However, until it is patched, users can protect themselves against potential cyber attacks by changing the network card of their "virtual machines to PCnet (either of two) or to Paravirtualized Network."

Though the researcher stressed that the above approach is more secure, in case if you are unable to do that, you can change the mode from NAT to another one.