5 ms·
Would this work with a headless VM only accessed via SSH? I naively perhaps assume it would be safe as its not using a virtual vga device but perhaps the machin
by smegger001 1y ago
Would this work with a headless VM only accessed via SSH? I naively perhaps assume it would be safe as its not using a virtual vga device but perhaps the machines still has the vga device present in the virtual environment it just not being used by the user but still vulnerable?
also is this specific to any particular host operating system or all versions of virtualbox?
- bobmcnamara 1y agoAvailability of the VM device is up to the host's configuration for that VM. You can remove it, but there's one display present by default - don't recall which
- orev 1y agoAll* PCs require a VGA console to boot. Maybe there’s some special type that doesn’t, but it would be extremely rare. When running headless it’s just hiding the console window, but the device still exists on the machine.
- Retr0id 1y agoLinux has no problem booting without a VGA device present
- _flux 1y agoThat's true, but there may be some some desktop BIOSes that will fail to boot without a display adapter—though I've had good luck on that on the few hosts I've made headless servers.
- Retr0id 1y agoFortunately the BIOSes shipping in hypervisors tend to be more sane, and QEMU for example can direct-boot a linux kernel without even needing to emulate a BIOS/EFI first.
- da768 1y agoNetwork appliances (Lanner, Netgate, Axiomtek, PC Engines, etc) typically only have a serial console and no GPU hardware at all. Same applies for any linux VMs, you can remove VGA devices and keep a serial port in the config
- fulafel 1y agoDespite the title, the vulnerable function name (vmsvga3dSurfaceMipBufferSize) tells it's in the VMSVGA virtual 3D graphics device, not basic VGA hardware needed for normal bootup console stuff.
- rjsw 1y agoIf the kernel in the VM has the DRM code loaded into it, maybe as a module, then I think you would be able to trigger this bug.