Researchers Detail VirtualBox Guest-to-Host Exploit That Won Pwn2Own 2025
· 26:56 · Watch on YouTube ↗
Summary
A team describes VirtualBox VGA and network-device flaws used to build a guest-to-host exploit. The speaker reports adapting it for Pwn2Own 2025, where the team won the virtualization category.
Key points
- The speaker describes how Korea’s Best of the Best training program and mentorship helped the student team, named Prison Break, develop its virtualization research.
- The team found a flaw in VirtualBox’s VGA rectangle-copy handling: guest-controlled values could bypass a bounds check and enable out-of-bounds memory access.
- The talk also describes an out-of-bounds write in the VirtualBox network device’s GSO handling. The speaker says this flaw was patched before the competition.
- The speaker reports adapting the exploit after the competition target guest changed to Red Hat Linux, and says the resulting exploit had over 90% reliability.
- In the demo, the speaker shows VirtualBox 7.1.8 with a Red Hat Linux guest and Windows 11 host; the exploit executes Calculator on the host.
- The team says it won the virtualization category at Pwn2Own Berlin 2025. The speaker notes that the VGA exploit disrupted the guest display.
Article Details
- Topics
- [00:29] Korean cybersecurity education and formation of the Prison Break team
- [05:21] Type 2 hypervisors, guest-to-host attack surfaces, and virtual-device handling
- [10:38] VirtualBox VGA flaw, bounds-check bypass, and out-of-bounds memory access
- [15:14] VirtualBox network-device GSO out-of-bounds write
- [17:36] Exploit redesign following patching and changes to the competition target
- [19:45] Heap allocation and USB structures in the exploit chain
- [24:14] Exploit demonstration and Pwn2Own 2025 result
People
Han-seo KimSpeaker and researcher who presented the team's VirtualBox vulnerability and exploit work; the transcript introduction renders his name as Hanzo Kim.Jung ShinNamed mentor to the team conducting virtualization software research.Kangun JangNamed mentor to the team; the speaker says he won a Pwn2Own category the previous year.