VirtualBox SBX Vulnerability

The vulnerability appears to lie in how the 82540EM adapter handles the context and data transmit (Tx) descriptors used to contain network packets. Typically, all descriptors are written to a physical memory buffer, with data descriptor packets required to be smaller than the maximum size of a context descriptor packet. If the packets are manipulated so that the data descriptor packets are larger than this size, it can cause a buffer overflow. This results in the affected virtual machine terminating itself and ejecting the user into the primary operating system.

Exploiting this vulnerability would allow an attacker with administrative privileges to escape the virtual machine and gain access to the Ring 3 privilege layer (the least privileged layer, used by most user applications). They would then be free to execute other applications or exploit vulnerabilities to escalate their privileges.