Oracle VirtualBox virtio-net Uninitialized Memory Information Disclosure Vulnerability

ID ZDI-20-887
Type zdi
Reporter Reno Robert
Modified 2020-07-20T00:00:00


This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the virtio-net component. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the hypervisor.