From ${URL} : Description Core Security has reported multiple vulnerabilities in Oracle VirtualBox, which can be exploited by malicious, local users in a guest virtual machine to gain escalated privileges. 1) An error within the "crNetRecvReadback()" function (src/VBox/GuestHost/OpenGL/util/net.c) can be exploited to overwrite arbitrary hypervisor memory contents. 2) Two errors within the "crNetRecvReadback()" and "crNetRecvWriteback()" functions (src/VBox/GuestHost/OpenGL/util/net.c) can be exploited to manipulate arbitrary hypervisor memory contents. 3) A boundary error within multiple generated "crServerDispatchVertexAttrib*ARB()" functions (src/VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py) can be exploited to cause a buffer overflow. Successful exploitation of these vulnerabilities may allow execution of arbitrary code with hypervisor privileges. The vulnerabilities are reported in versions 4.2.20 and 4.3.6. Other versions may also be affected. Solution: Update to version 4.3.8. Provided and/or discovered by: Francisco Falcon, Core Exploit Writers Team. Original Advisory: Oracle VirtualBox: https://www.virtualbox.org/changeset/50437/vbox https://www.virtualbox.org/changeset/50441/vbox Core Security: http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities @maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.
CVE-2014-0983 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0983): Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function. CVE-2014-0981 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0981): VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption. NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.
=app-emulation/virtualbox-4.3.8 hit tree via https://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/app-emulation/virtualbox/virtualbox-4.3.8.ebuild?hideattic=0&view=log Current stable version in tree is =app-emulation/virtualbox-4.3.38 and no vulnerable version left. So all done. Added to existing GLSA.
This issue was resolved and addressed in GLSA 201612-27 at https://security.gentoo.org/glsa/201612-27 by GLSA coordinator Kristian Fiskerstrand (K_F).
