Researchers Demonstrate VirtualBox Escape and Windows Privilege-Escalation Chain
· 25:39 · Watch on YouTube ↗
Summary
Thomas Imbert and Thomas Bouzerar described a VirtualBox guest-to-host escape using a TPM-related stack overflow and information leak, followed by a Windows kernel-driver flaw that enabled escalation to SYSTEM.
Key points
- The presenters described a Pwn2Own Vancouver 2023 exploit chain: escape from a VirtualBox guest to the Windows host, then escalate privileges.
- A missing bounds check in VirtualBox’s TPM-related MMIO handler allowed a guest-controlled length to overflow a stack buffer.
- They described a separate failed guest-memory read that could disclose host stack data, supporting ASLR bypass and a ROP chain.
- A Windows kernel streaming driver failed to validate a user-supplied buffer address and used a kernel-mode mapping flag; the presenters said changing the flag fixes the issue.
- They used the driver flaw to access and modify a process token, then obtain a SYSTEM shell.
- The presenters said Windows Defender flagged their second-stage payload during their first attempt.
Article Details
- Topics
- [01:00] Pwn2Own Vancouver 2023 target and the goal of chaining a VirtualBox escape with Windows privilege escalation
- [02:02] VirtualBox device emulation and the guest-to-host attack surface
- [03:28] TPM emulation code review and discovery of a stack buffer overflow
- [11:17] Failed guest-memory reads as a source of host stack data for an information leak
- [15:17] Windows kernel streaming driver flaw in shared-memory buffer mapping
- [21:01] Process-token modification to obtain SYSTEM privileges
- [23:50] Exploit-chain results, reliability and the Windows Defender obstacle