Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VirtualBox E1000 Guest-to-Host Escape

github.com

Post reply on HN
Print view View original

101–110 of 118 posts

Re: VirtualBox E1000 Guest-to-Host Escape

#101

Post by SOLAR_FIELDS »

AlexanderDhoore wrote: post #94
skocznymroczny wrote: post #73

Earlier quoted context omitted.

"You need to think of Larry Ellison the way you think of a lawnmower. You don't anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it'll chop it off, the end. You don't think 'oh, the lawnmower hates me' -- lawnmower doesn't give a shit about you, lawnmower can't hate you. Don't anthropomorphize the lawnmower. Don't fall into that trap about Oracle."

https://www.youtube.com/watch?v=-zRN7XLCRhc

Entertaining talk.

The part that grandparent is quoting starts at about 38 minutes in.

Re: VirtualBox E1000 Guest-to-Host Escape

#102

Post by [deleted] »

skocznymroczny wrote: post #73
SOLAR_FIELDS wrote: post #53

Earlier quoted context omitted.

Does Oracle have a track record of being The Worst about this or should I have assumed as such given my preconceived notions of them being the classic villain in the tech world?

"You need to think of Larry Ellison the way you think of a lawnmower. You don't anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it'll chop it off, the end. You don't think 'oh, the lawnmower hates me' -- lawnmower doesn't give a shit about you, lawnmower can't hate you. Don't anthropomorphize the lawnmower. Don't fall into that trap about Oracle."

[deleted]

Re: VirtualBox E1000 Guest-to-Host Escape

#103

Post by umbs »

I have a slightly off topic observation and couple of questions. Hoping to get inputs from community. I'm half way through the write up and am amazed by the amount of research, skill and grit that went in to finding this vulnerability. Few questions I have:

1. How do vulnerability researchers and RE engineers narrow down which code base to test? VirtualBox code could be so huge.

2. If their research leads to dead end, which I guess may happen most of the time, how do they keep themselves going/motivated?

3. Clearly, this work needs lots of time. How do they fund themselves to do this?

4. I believe a certain mindset is required to continue doing this work because most of this is 'altruistic' in nature. The monetary reward is a pittance. Would love to read some books on such topics.

Re: VirtualBox E1000 Guest-to-Host Escape

#104

Post by zkomp »

skocznymroczny wrote: post #73
SOLAR_FIELDS wrote: post #53

Earlier quoted context omitted.

Does Oracle have a track record of being The Worst about this or should I have assumed as such given my preconceived notions of them being the classic villain in the tech world?

"You need to think of Larry Ellison the way you think of a lawnmower. You don't anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it'll chop it off, the end. You don't think 'oh, the lawnmower hates me' -- lawnmower doesn't give a shit about you, lawnmower can't hate you. Don't anthropomorphize the lawnmower. Don't fall into that trap about Oracle."

It's even better when he slips and say: "Don't anthropomorphize Larry Ellison"

Re: VirtualBox E1000 Guest-to-Host Escape

#105

Post by FartyMcFarter »

ikeboy wrote: post #95
zaroth wrote: post #93

Earlier quoted context omitted.

“Unreproducible” can also be read as “Wasn’t worth the effort to reproduce”. Very, very rarely will a Sev1 crash in production software be instantly reproducible. When it is, it’s an utter embarrassment. More often the full set of conditions which lead to the crash are unknown, rare, and hard to fully quantify all at once. And yet, we know with certainty that the crash did happen and by definition it is a valid bug i…

"don't crash" can't be an absolute requirement, because operating systems. I've had programs crash when running out of RAM, I think sometimes there's no way for the OS to recover without killing some programs. If you absolutely can't crash, you need to build an OS that caters to that - modern OSes explicitly prioritize other goals, like performance

The usual definition of "crash" does not include "getting killed by the OS while behaving normally".

Re: VirtualBox E1000 Guest-to-Host Escape

#106

Post by davio »

vlan0 wrote: post #98
Uberphallus wrote: post #61

Earlier quoted context omitted.

Oracle has a track record of being The Worst about anything.

They seem to have a knack for selling their product to C-levels who don't fully understand the business they represent. But that's about it.

CIOs at my last 3 companies have each had a "get rid of Oracle" as a top 5 strategic goal for the year.

Re: VirtualBox E1000 Guest-to-Host Escape

#107

Post by ChickeNES »

exikyut wrote: post #38
ChickeNES wrote: post #21

Oh, this might explain how I managed to cause the host OS to crash while running my homebrew OS when I was in college...

Homebrew OS? Interesting. What did it do? Can I see it anywhere? What VM were you using? Host OS crashes like what you describe are no-trust-me-it's-really-not-the-compiler unlikely. I did have X crash on me once while figuring out the X11 protocol specification, but that's because X is widely known to be less than perfectly stable :D and also because the actual graphics driver I was using was a little flaky.

I took an OS class and wanted to learn more afterwards so I hacked together a small kernel mostly using info from the osdev wiki. I got decently far (managed to have a shell running, had VIM running), but ran out of steam years ago (that and the code needing a massive amount of cleanup and auditing).

So I misremembered (it's been 6+ years ago) but it was the AMD PCNET driver I wrote that triggered the crash, not E1000. Excuse the code quality, but the driver I wrote is located here: https://github.com/blanham/ChickenOS/blob/master/src/device/... (Note the comment about it not working in Virtualbox) Attempting to boot my kernel with that driver activated would cause a hard freeze of the host OS, requiring a hard reset of the host machine. I replicated this multiple times, in Virtualbox for both OSX and Windows.

Thanks for actually replying instead of downvoting, I guess I shouldn't make off-the-cuff comments and then forget to follow-up until the next day.

Re: VirtualBox E1000 Guest-to-Host Escape

#108

Post by ikeboy »

FartyMcFarter wrote: post #105
ikeboy wrote: post #95

Earlier quoted context omitted.

"don't crash" can't be an absolute requirement, because operating systems. I've had programs crash when running out of RAM, I think sometimes there's no way for the OS to recover without killing some programs. If you absolutely can't crash, you need to build an OS that caters to that - modern OSes explicitly prioritize other goals, like performance

The usual definition of "crash" does not include "getting killed by the OS while behaving normally".

If you're in a scenario where a crash can mean a critical security vulnerability, then being killed by the OS can also be, because some parts might continue running with an unexpected state

Re: VirtualBox E1000 Guest-to-Host Escape

#110

Post by nickpsecurity »

xupybd wrote: post #23
metildaa wrote: post #3

Earlier quoted context omitted.

The author has a number of great points, with an overarching theme that how we handle security bugs is ridiculous.

You don't think there is a place for giving vendors time to fix the exploit before handing it over to everyone who can use it maliciously?

I think the market should demand and suppliers offer a better baseline of security in prevention and turnarounds for fixes. The market mostly doesn't pay for better security. Suppliers mostly don't care either. So, most software is intentionally vulnerable with users/buyers accepting and rewarding that. That means 0-days are coming no matter what, esp if development processes don't improve. Publishing a 0-day seems at least no more unethical than the demand and supply side intentionally putting them there in the first place. I've actually started thinking security people should cash in on the practice in a way that funds secure alternatives like I said on Lobste.rs version of this article:

"There’s no regulations or liability. The market largely doesn’t care. They outsource security work, even stuff as easy as 15 min of AFL, to unpaid labor that has to beg for payouts that are often below market rate for paid, security professional. If they refuse to do secure development, I say just publish the vulnerabilities or sell them to Zerodium. Also, keep recommending secure alternatives to common, vulnerable software.

I did have another idea when looking at the fact that high-security software is always too expensive for most to buy or sold/free at a loss. Companies like Zerodium pay a fortune for vulnerabilities in software. It’s always the same software, too, whose developers keep adding preventable vulnerabilities. Usually a company making piles of money off it, too. So, sell vulnerabilities in those apps which already have red flags for security-conscious users, make a bit of money for yourself out of that, and spend the rest (eg majority) on developing secure alternatives. For example, selling vulnerabilities in Nginx to carefully extend and tool-check lwan, in consumer routers to fund an OpenBSD-based router, and/or iOS to fund HardenedAndroid (or new mobile OS). Stuff like that.

Hardly anyone will pay for real security. They’ll pay for vulnerabilities, though. Sad it comes to ideas like that but it’s one of the only ones that easily generates the required revenue."

https://lobste.rs/s/kjvb2i/virtualbox_e1000_guest_host_escap...

Post reply on HN