Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 26 Apr 2021 15:21:16 +0200
From: Matthias Gerstner <>
Subject: virtualbox: CVE-2021-2264: allows injection
 of parameters in 'su' invocation


I recently discovered an issue in the script ""
which is distributed by Oracle as part of their virtualbox RPMs [1]. By
default this script is not used but it can be enabled by an
Administrator according to the manual [2].

In the context of the autostart feature a directory "$VBOXAUTOSTART_DB"
(by default /etc/vbox) is used. Local users in the system are granted
write access to this directory. Users are supposed to create files of
the form "<username>.start" to configure autostarting of their
respective virtualbox VMs.

The version of the script in virtualbox release 6.1.18 (and older
releases) runs as root and uses the following bash for loop in its
`start()` function:

    for user in `ls $VBOXAUTOSTART_DB/*.start`
        start_daemon `basename $user | sed -ne "s/\(.*\).start/\1/p"` $binary $PARAMS > /dev/null 2>&1


    start_daemon() {
        su - $usr -c "$*"

Since by design unprivileged users need to have write access to this
directory, an unprivileged user can create arbitrarily named new files
in it that will be processed by the for loop above.

If a user creates a file like "$VBOXAUTOSTART_DB/--evil.start", then the
for loop will pass "--evil" as parameter to `start_daemon()`, resulting
in the command line flag `--evil` being passed to the `su` utility. A
reproducer for the openSUSE virtualbox package, which uses an older but
similarly vulnerable autostart script, looks like this:

    # emulate a malicious user that is a member of the vboxusers group
    root# su -g vboxusers nobody
    nobody$ cd /etc/vbox
    # try to inject a parameter to 'su'
    nobody$ touch -- '-s myshell.start'
    nobody$ exit
    # execute the autostart script
    root# /usr/lib/virtualbox/ start Starting VirtualBox VMs configured for autostart. Starting VMs for user -s myshell.
    # execution fails, because we cannot embed '/' characters in
    # filenames
    su: failed to execute  myshell: No such file or directory

Luckily this is not a full local root exploit. Two aspects are reponsible for

- filenames cannot contain '/' characters, therefore we cannot specify
  any valid executable beyond the CWD (usually "/") of the script.
- the $user argument is passed before the `-c /usr/lib/virtualbox/VBoxAutostart`
  parameter. And the command line parsing logic of 'su' lets the final
  `-c` parameter win, i.e. the attacker cannot influence the command that is run.

Still a local attacker can specify arbitrary other parameters to `su` this way
e.g. the `--group=mygroup` parameter. It could be a successful attack vector
when combined with other security issues.

Beyond this any member of the vboxusers group can influence the autostart
settings of other users, as long as the victim user is allowed to
autostart via /etc/vbox/autostart.cfg.

On a more generic level this design of /etc/vbox as "autostart DB"
allows any member of the vboxusers group to trigger a run of
/usr/lib/virtualbox/VBoxAutostart as any local user (by influencing the
$user value) or as root with any local group (by setting $user to

I privately reported this issue to Oracle Security on 2021-04-08. It has
been fixed via a critical patch update by upstream on 2021-04-20. The
fixed version of the script has stronger limitations on the accepatble
*.start filenames and also requires that the username present in the
file matches the owner of the file.

The openSUSE packages for virtualbox are about to receive updates [3].




Matthias Gerstner <>
Dipl.-Wirtsch.-Inf. (FH), Security Engineer
Phone: +49 911 740 53 290
GPG Key ID: 0x14C405C971923553
SUSE Software Solutions Germany GmbH
HRB 36809, AG Nürnberg
Geschäftsführer: Felix Imendörffer

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.