VirtualBox E1000 Guest-to-Host Escape
github.com
VirtualBox E1000 Guest-to-Host Escape
1–10 of 118 posts
Re: VirtualBox E1000 Guest-to-Host Escape
#2I enjoyed reading the author's motivation for posting as a 0day vs Bug bounty.
Re: VirtualBox E1000 Guest-to-Host Escape
#3I enjoyed reading the author's motivation for posting as a 0day vs Bug bounty. https://github.com/MorteNoir1/virtualbox_e1000_0day#why
The author has a number of great points, with an overarching theme that how we handle security bugs is ridiculous.
Re: VirtualBox E1000 Guest-to-Host Escape
#4Great and very thorough writeup; the one biggest question I have left, is what happens if you do this with the real hardware. Will it crash the hardware and put it in a weird state, or will it do something natural and benign like wrapround an internal counter modulo 16K?
Re: VirtualBox E1000 Guest-to-Host Escape
#5Not to discount the work done here. Big high five. But I am surprised hundreds more of these bugs haven't found every week. It's Oracle. Their mission statement might as well be "we make security vulnerabilities and charge you a shitload"
I would never trust any Oracle product in any form in production environment.
Re: VirtualBox E1000 Guest-to-Host Escape
#6I enjoyed reading the author's motivation for posting as a 0day vs Bug bounty. https://github.com/MorteNoir1/virtualbox_e1000_0day#why
With regard to this, maybe there’s an opportunity for a market maker to step in.
An “Uber for vulnerabilities”.
Having said that, I do tend to think “slap a market on it” can often lead to perverse outcome.
Re: VirtualBox E1000 Guest-to-Host Escape
#7Not to discount the work done here. Big high five. But I am surprised hundreds more of these bugs haven't found every week. It's Oracle. Their mission statement might as well be "we make security vulnerabilities and charge you a shitload" I would never trust any Oracle product in any form in production environment.
I hate Oracle and consider them among the most evil of companies out there. However, I don't think that's a very fair characterization of their mission statement.
Re: VirtualBox E1000 Guest-to-Host Escape
#8I enjoyed reading the author's motivation for posting as a 0day vs Bug bounty. https://github.com/MorteNoir1/virtualbox_e1000_0day#why
I find that part really weird. These are two extremes - you can easily notify the vendor and give them a month (or whatever period you think is reasonable) to fix the issue if you're not interested in the bounty. Google was pretty successful with enforcing 3 months. VirtualBox may not be a production service where it really matters, but publishing a 0day makes for some stressful days for many ops.
Re: VirtualBox E1000 Guest-to-Host Escape
#9I enjoyed reading the author's motivation for posting as a 0day vs Bug bounty. https://github.com/MorteNoir1/virtualbox_e1000_0day#why
With regard to this, maybe there’s an opportunity for a market maker to step in. An “Uber for vulnerabilities”. Having said that, I do tend to think “slap a market on it” can often lead to perverse outcome.
I think the author is referring to third parties which buy and disclose vulnerabilities. Very hard to monetize. There is already a flourishing market for undisclosed vulnerabilities, for obvious reasons.
Re: VirtualBox E1000 Guest-to-Host Escape
#10Not to discount the work done here. Big high five. But I am surprised hundreds more of these bugs haven't found every week. It's Oracle. Their mission statement might as well be "we make security vulnerabilities and charge you a shitload" I would never trust any Oracle product in any form in production environment.
To be fair, this is Sun (or probably Innotek) code almost certainly. Sun I generally trusted in production.