VirtualBox emulates OHCI (USB 1.1), EHCI (USB 2.0), and xHCI (USB 3.0) host controllers. The guest driver programs a controller through registers and builds its data structures, endpoint and transfer descriptors for OHCI/EHCI, and the command, event, and transfer rings of TRBs for xHCI, in guest memory, which the host VM process reads by DMA to perform transfers. Walking those guest-built structures is the escape surface, and the xHCI model in particular has been a VirtualBox escape vector, including at Pwn2Own.
The surface#
// xHCI: the guest sets ring base registers and writes TRBs (type, flags, ptr, len).
// the host walks the command/transfer rings following link TRBs and tracks per-slot
// device contexts and endpoints. Primitives:
// - a link TRB forming a cycle or pointing out of range -> over-read when walked
// - a transfer length the host uses for a copy beyond the mapped buffer
// - a slot/endpoint index used to index context arrays without bounds -> OOB/UAF
// OHCI/EHCI: endpoint/transfer descriptor lists with the same descriptor-walk classes
lspci -nn | grep -i usb # OHCI/EHCI/xHCI present (xHCI needs the extension pack era config)
# an attacker guest USB driver programs the rings/descriptors directly
Exploitation notes#
- xHCI is the richest target because the host tracks substantial per-slot and per-endpoint state, giving type-confusion and use-after-free opportunities on context setup/teardown in addition to ring-walk over-reads.
- The guest controls the ring/descriptor base and contents from its driver; exploitation programs the controller directly rather than attaching a device normally.
- The same controller models appear in QEMU and VMware, so xHCI bugs recur across hypervisors; see QEMU USB controllers.
- Primitives land in the VM process; version-specific, pair with a leak.