Oracle VM VirtualBox Core Takeover Vulnerability

Repository contains a Linux kernel-module exploit targeting Oracle VirtualBox, with 4 files total: a minimal README, a Makefile for building an out-of-tree kernel module, a large copied VirtualBox header (VMMDev.h) defining HGCM/VMMDev structures and constants, and the main exploit source exp.c. The exploit is not a framework module; exp.c is the primary entry point. The exploit logic is guest-to-host escape oriented. In exp_init(), it maps VGA MMIO at 0xa0000, creates a device/class object, allocates a 32-bit coherent DMA buffer, and repeatedly performs a spray() plus vga_oob_read() loop until it discovers a VBoxC base address. The spray path uses crafted HGCM requests via VMMDevReq_HGCMCall64 and GUEST_PROP_FN_GET_NOTIFICATION, dispatched through the VirtualBox VMMDev I/O port 0xd040. This appears intended to shape host-side heap state and place recognizable patterns for later leakage. After locating the VBoxC base, the exploit enters a second stage using TPM MMIO at 0xfed40000. The tpm_oob_write() routine builds a hardcoded ROP chain using VBoxC-relative gadget offsets and an import-table-relative calculation. The payload is operational rather than generic: it is tuned to execute WinExec-like behavior with the string 'calc', indicating host-side arbitrary code execution on a Windows host process. The chain is delivered bytewise through TPM FIFO registers and triggered with fxrstor64 against TPM_XDATA_FIFO. Overall capability: local privileged guest exploit for VirtualBox escape, combining HGCM heap spraying, VGA out-of-bounds read for information disclosure, and TPM-based out-of-bounds write / control-flow hijack for host code execution. No network communication is present; the relevant endpoints are MMIO bases, I/O ports, kernel build paths, and VirtualBox request/function identifiers.

This repository is a proof-of-concept (PoC) exploit for CVE-2023-21987, an out-of-bounds read vulnerability in the Oracle VirtualBox VGA device. The exploit is implemented as a Linux kernel module (poc.c) intended to be loaded in a Linux guest running inside VirtualBox on a Windows host. The module creates a device node ('/dev/exp'), maps the VGA memory region (0xa0000), and performs memory spraying using the VirtualBox Host-Guest Communication Manager (HGCM) service 'VBoxGuestPropSvc'. It then attempts to read out-of-bounds from the VGA memory to leak addresses of VirtualBox components, demonstrating the vulnerability. The vmmdev.h header provides necessary VirtualBox structures and constants. The exploit does not provide code execution or privilege escalation, but demonstrates an infoleak that could be used for further exploitation. The repository is structured with a README.md describing the exploit, poc.c containing the main exploit logic, and vmmdev.h providing VirtualBox-specific definitions.