VirtualBox emulates OHCI, EHCI, and XHCI USB host controllers in the host-side VM process. They process the guest's transfer descriptors and schedules, and the emulated devices handle guest requests. Flaws in the controller or device handling corrupt host memory, a recurring VirtualBox escape surface.
USB escape surface:
- Host controllers: OHCI, EHCI, XHCI (transfer descriptor / schedule parsing)
- Emulated USB device models
Exploitation notes#
- The XHCI controller has the richest surface; reachability requires a USB controller on the guest, which is commonly present.
- VirtualBox's open-source device code makes these controllers heavily audited, with public findings.
- Code execution lands in the host VM process, then escalates.