5 ms·

VM escape vulnerabilities patched in VirtualBox

121 points by emptysands 9y ago

omgbananas 9y ago
Do any of these affect the host when it's Linux? I run several VMs at the same time, occasionally one will freeze. I think it's just the video/display that freezes while the browser/whatever in the guest VM still operates normally.
- emptysands 9y ago
  https://blogs.securiteam.com/index.php/archives/3649 https://blogs.securiteam.com/index.php/archives/3649 "The vulnerabilities found in the core graphics framework (VBVA subcomponent) and affect all host operating systems."
mirimir 9y ago
The title should really say that they've been patched. Edit: The first sentence: > Oracle has released patches for ten vulnerabilities in VirtualBox which allow attackers to break out of guest operating systems and attack the host operating system that VirtualBox runs on. And at http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixOVIR http://www.oracle.com/technetwork/security-advisory/cpujan20... > Supported Versions Affected ... Prior to 5.1.32, Prior to 5.2.6 The current version being 5.2.6 https://www.virtualbox.org/wiki/Downloads https://www.virtualbox.org/wiki/Downloads
- dang 9y ago
  OK, we s/discovered/patched/ the title above. Since something can't be patched before it is discovered this seems strictly more informative.
  - mirimir 9y ago
    Thanks. The article didn't say when the vulnerabilities were discovered. Depending who discovered them, it could have been months or more. I brought it up to clarify that these aren't unpatched vulnerabilities.
deleted 9y ago
[deleted]
krylon 9y ago
I am definitely not complaining, but I wonder why Oracle continues work on VirtualBox at all? When they acquired Sun, they seemed in a hurry to kill off all the other open source projects Sun had been running. Do they use it as the basis for their cloud-infrastructure[1] or what? I do not see how VirtualBox generates any revenue for Oracle, and they have a reputation for being very ... focussed when it comes to revenue. [1] That seems pretty unlikely
- userbinator 9y ago
  They have a closed-source "extension pack" with a bunch of quite useful and even necessary features (e.g. USB 2.0) so that could be their revenue source, but looking around it seems that others have been rather unsuccessful at actually trying to pay for it --- the response Oracle has given them is "you can use and redistribute it for free".
  - krylon 9y ago
    Huh. Next thing you know Microsoft is going to host all Windows and Office development on public github repos, IBM begins lobbying against software patents, and GNU/Hurd reaches 1.0... These are interesting times we live in for sure.
    - TheSpiceIsLife 9y ago
      Tangential related, didn't I see recently that IBM has a patent on patent trolling?
      - krylon 9y ago
        If so, that could be the starting point for the ... most interesting lawsuit ever.
        TheSpiceIsLife 9y ago
        I just sort of noticed the headline somewhere, haven't really looked in to it. This NPR article has more detail: https://www.npr.org/sections/money/2012/08/01/157743897/can-you-get-a-patent-on-being-a-patent-troll https://www.npr.org/sections/money/2012/08/01/157743897/can-...
snowpanda 9y ago
What is the alternative to using Virtualbox besides buying a separate computer? I'm assuming there's more vulnerabilities to be found.
- pipeep 9y ago
  > What is the alternative to using Virtualbox Any other hypervisor. QEMU/KVM, Xen, VMWare, and Parallels all have good track records.
  - sedachv 9y ago
    Xen doesn't: https://www.cvedetails.com/vulnerability-list/vendor_id-6276/XEN.html https://www.cvedetails.com/vulnerability-list/vendor_id-6276...
    - TheDong 9y ago
      Xen has a very responsible track record; they communicate clearly the scope and detail of vulnerabilities. This skews the CVE stats significantly since the kernel developers (aka kvm) rarely actually request CVE ids.
      - bonzini 9y ago
        Ehm, I always request CVE ids. KVM has had no serious VM escape in quite some time.
- krylon 9y ago
  On Linux, qemu/kvm works well enough for most purposes, on FreeBSD you have bhyve. OpenBSD's vmm is a thing, but I do not know if it can host other systems than OpenBSD, yet. On Windows, there is Hyper-V. I have only very little experience with it, but in my short time, I did not encounter anything I would like to complain about. I am not sure, however, if it comes with the client editions of Windows. Microsoft Virtual PC still exists, too. Xen is also a thing - run Dom0 as your desktop system, and run the VMs in the background. None of this is perfect, but if you need them, there are alternatives.

121 points by emptysands 9y ago

Do any of these affect the host when it's Linux? I run several VMs at the same time, occasionally one will freeze. I think it's just the video/display that freezes while the browser/whatever in the guest VM still operates normally.

emptysands 9y ago
https://blogs.securiteam.com/index.php/archives/3649 https://blogs.securiteam.com/index.php/archives/3649 "The vulnerabilities found in the core graphics framework (VBVA subcomponent) and affect all host operating systems."

mirimir 9y ago

The title should really say that they've been patched. Edit: The first sentence: > Oracle has released patches for ten vulnerabilities in VirtualBox which allow attackers to break out of guest operating systems and attack the host operating system that VirtualBox runs on. And at http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixOVIR http://www.oracle.com/technetwork/security-advisory/cpujan20... > Supported Versions Affected ... Prior to 5.1.32, Prior to 5.2.6 The current version being 5.2.6 https://www.virtualbox.org/wiki/Downloads https://www.virtualbox.org/wiki/Downloads

dang 9y ago
OK, we s/discovered/patched/ the title above. Since something can't be patched before it is discovered this seems strictly more informative.
- mirimir 9y ago
  Thanks. The article didn't say when the vulnerabilities were discovered. Depending who discovered them, it could have been months or more. I brought it up to clarify that these aren't unpatched vulnerabilities.

deleted 9y ago

[deleted]

krylon 9y ago

I am definitely not complaining, but I wonder why Oracle continues work on VirtualBox at all? When they acquired Sun, they seemed in a hurry to kill off all the other open source projects Sun had been running. Do they use it as the basis for their cloud-infrastructure[1] or what? I do not see how VirtualBox generates any revenue for Oracle, and they have a reputation for being very ... focussed when it comes to revenue. [1] That seems pretty unlikely

userbinator 9y ago
They have a closed-source "extension pack" with a bunch of quite useful and even necessary features (e.g. USB 2.0) so that could be their revenue source, but looking around it seems that others have been rather unsuccessful at actually trying to pay for it --- the response Oracle has given them is "you can use and redistribute it for free".
- krylon 9y ago
  Huh. Next thing you know Microsoft is going to host all Windows and Office development on public github repos, IBM begins lobbying against software patents, and GNU/Hurd reaches 1.0... These are interesting times we live in for sure.
  - TheSpiceIsLife 9y ago
    Tangential related, didn't I see recently that IBM has a patent on patent trolling?
    - krylon 9y ago
      If so, that could be the starting point for the ... most interesting lawsuit ever.
      - TheSpiceIsLife 9y ago
        I just sort of noticed the headline somewhere, haven't really looked in to it. This NPR article has more detail: https://www.npr.org/sections/money/2012/08/01/157743897/can-you-get-a-patent-on-being-a-patent-troll https://www.npr.org/sections/money/2012/08/01/157743897/can-...

snowpanda 9y ago

What is the alternative to using Virtualbox besides buying a separate computer? I'm assuming there's more vulnerabilities to be found.

pipeep 9y ago
> What is the alternative to using Virtualbox Any other hypervisor. QEMU/KVM, Xen, VMWare, and Parallels all have good track records.
- sedachv 9y ago
  Xen doesn't: https://www.cvedetails.com/vulnerability-list/vendor_id-6276/XEN.html https://www.cvedetails.com/vulnerability-list/vendor_id-6276...
  - TheDong 9y ago
    Xen has a very responsible track record; they communicate clearly the scope and detail of vulnerabilities. This skews the CVE stats significantly since the kernel developers (aka kvm) rarely actually request CVE ids.
    - bonzini 9y ago
      Ehm, I always request CVE ids. KVM has had no serious VM escape in quite some time.
krylon 9y ago
On Linux, qemu/kvm works well enough for most purposes, on FreeBSD you have bhyve. OpenBSD's vmm is a thing, but I do not know if it can host other systems than OpenBSD, yet. On Windows, there is Hyper-V. I have only very little experience with it, but in my short time, I did not encounter anything I would like to complain about. I am not sure, however, if it comes with the client editions of Windows. Microsoft Virtual PC still exists, too. Xen is also a thing - run Dom0 as your desktop system, and run the VMs in the background. None of this is perfect, but if you need them, there are alternatives.