phantomn/virtualbox_cve-2019-2525-cve-2019-2548Proof-of-concept exploits for VirtualBox guest-to-host escape vulnerabilities CVE-2019-2525 and CVE-2019-2548, with a Python library for HGCM interface experimentation and a simple fuzzer for the VBoxSharedCrOpenGL service.
Author: @_niklasb
See the subdirectories other than lib.
For Arch Linux, you can use the provided PKGBUILD in archpkg to get a debug version of
5.2.18, with the 3D security fixes from July 2018 reverted.
lib/hgcm.py and lib/chromium.py provide high-level access to the HGCM interface and
to the VBoxSharedCrOpenGL service, via VBoxGuest IOCTLs.
can be used to very easily experiment with Chromium from Python
inside the guest. I used it to build a very simple, completely dumb fuzzer that
found multiple trivial crashes in minutes.
chromium.py