Hi, Tested this on Windows 7 x64 host instead (no Linux box available atm); confirmed the issue (consumes CPU and kills the host network adapter).
Can someone assign a CVE for this? Looks like this can be exploited to at least DoS other VMs on the same host. 2013/6/21 Thomas Dreibholz <[email protected]> > Hi, > > I have discovered a problem with the VirtualBox virtio-net network driver > that > leads to a lockup of the host machine's kernel and the need for a hard > reset > to make it working again. The bug had been reported to the VirtualBox bug > tracker 8 days ago (https://www.virtualbox.org/ticket/11863), with the > usual > reaction from Oracle support (i.e. none). > > The bug can be reproduced easily as follows: > > - The host system is a 64-bit Linux (tested with Ubuntu 12.04 LTS and > Kubuntu > 13.04). Did not try 32 bit. > > - VirtualBox is the latest version 4.2.12 (using Oracle's Ubuntu > repository). > > - Create a new VM, use e.g. Kubuntu live CD image (32 or 64 bit, makes no > difference). No disk needed. > > - Network adapter is: Bridged, Adapter Type: virtio-net. > Boot the system, ensure that network is working. > > - tracepath 8.8.8.8 > Now, the virtual machine locks up and the host machine's kernel seems to > have > at least one core blocked. The host machine's console output is "BUG: soft > lockup - CPU #2 stuck for 22s ...". Also, the network on the host machine > does > not work any more. For example, "ifconfig" just hangs. > > - To recover the host machine, it needs a hard reset. "sudo reboot", etc. > will > not work, since the kernel seems to hang. > > This bug is critical, since it makes the host machine's network unusable > (particularly, if the host system is at a remote location), and it is very > easy to trigger with just a simple, standard "tracepath" call inside a > virtual > machine. It is therefore trivial for a normal user in such a machine to > trigger a denial of service. I did no further investigation of the problem > yet, but if it is related to the path MTU discovery by tracepath, it might > be > possible to trigger it by a lot of other software as well. > > > Best regards, > > Thomas > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
