VirtualBox On Linux Affected By Security Vulnerability Leaking Host Data To Guests

Security researcher Jason Donenfeld who is known for leading the development of the WireGuard open-source software has outlined a new security vulnerability affecting the Oracle VM VirtualBox software.

When SIMD registers are used within interrupt handlers, it's possible for VirtualBox to leak data from the host to guest VMs.

If SIMD registers are used in interrupt handlers, apparently #VirtualBox will leak host register secret values into arbitrary guest VM processes. On 5.18 this takes the form of secret intermediate cryptographic hash values leaking into the guest. https://t.co/TlXKGy0Czn pic.twitter.com/xGvOuwouHO

— Edge Security (@EdgeSecurity) May 18, 2022

Donenfeld explained on the kernel mailing list:

I wrote a tiny reproducer that should be pretty reliable for testing this, attached below. I think this proves my working theory. Run this in a VirtualBox VM, and then move your mouse around or hit the keyboard, or do something that triggers the add_{input,disk}_randomness() path from a hardirq handler. On my laptop, for example, the trackpoint goes via hardirq, but the touchpad does not. As soon as I move the trackpoint around, the below program prints "XSAVE is borked!".

Also, note that this isn't just "corruption" of the guest VM, but also leaking secret contents of the host VM into the guest. So you might really want to make sure VirtualBox issues a fix for this before 5.18, as it's arguably security sensitive.

That came up in a patch series around preventing FPU state corruption stemming from recent changes in the random code. Separately earlier this month was this kernel thread about openSUSE's VirtualBox maintainer noticing Linux 5.18 crashing in VirtualBox VMs.

VirtualBox has yet to fix the problem on their end while Linux developer Thomas Gleixner added in the series:

That virtualborx bug has to be fixed in any case as this problem exists forever and there have been drivers using FPU in hard interrupt context in the past sporadically, so it's sheer luck that this didn't explode before. AFAICT all of this has been moved to softirq context over the years, so the random code is probably the sole in hard interrupt user in mainline today.

In the interest of users we should probably bite the bullet and just disable hard interrupt FPU usage upstream and Cc stable. The stable kernel updates probably reach users faster.

While VirtualBox is affected, KVM meanwhile is known not to be affected by this issue and the recommended choice for open-source Linux virtualization.