Thinking Outside The Box [dusted off draft from 2017]

Posted by Jann Horn Preface Hello from the future! This is a blogpost I originally drafted in early 2017. I wrote what I intended to be the first half of this post about escaping from the VM to the VirtualBox host userspace process with CVE-2017-3558, but I never got around to writing the second...

ROS-20251216-7344

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to access control flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the application...

ROS-20251216-7334

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to access control flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the application...

ROS-20251216-7327

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to access control flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the application...

ROS-20251216-7339

A vulnerability in the qemuFwCfgMmioRead function of the Box/Devices/PC/DevQemuFwCfg.cpp component of the Oracle VM VirtualBox virtualization software tool is related to integer overflow. Exploitation of the vulnerability may allow an intruder to gain unauthorized access to protected information...

ROS-20251216-7335

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to access control flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the application...

ROS-20251216-7329

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to access control flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the application...

ROS-20251216-7331

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to access control flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the application...

ROS-20251216-7333

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to access control flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the application...

ROS-20251216-7328

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to access control flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the application...

ROS-20251216-7326

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to access control flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the application...

ROS-20251216-7325

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to access control flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the application...

ROS-20251216-7324

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to access control flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the application...

USN-7935-1 linux-azure, linux-azure-6.8 vulnerabilities

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...

USN-7935-1: Linux kernel (Azure) vulnerabilities

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...

USN-7934-1 linux-azure, linux-azure-6.14 vulnerabilities

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. CVE-2024-36331 Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux...

USN-7934-1: Linux kernel (Azure) vulnerabilities

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. CVE-2024-36331 Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux...

SUSE SLED15: libvmtools-devel / libvmtools0 / open-vm-tools / etc (SUSE-SU-2025:03434-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03434-1 advisory. - CVE-2025-41244: local privilege escalation via the Service Discovery Plugin bsc1250373. Tenable has...

Oracle Linux 9 : open-vm-tools (ELSA-2025-17428)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-17428 advisory. - ovt-Address-CVE-2025-41244.patch RHEL-117390 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note tha...

SUSE SLES15: libvmtools-devel / libvmtools0 / open-vm-tools / etc (SUSE-SU-2025:03435-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03435-1 advisory. - CVE-2025-41244: local privilege escalation via the Service Discovery Plugin bsc1250373. Tenable has extracted the preceding description...