A VirtualBox VM runs inside a host process that emulates its devices, so escaping means making that process mishandle guest-controlled data. The device surface is broad: the 3D acceleration path (used by Guest Additions for accelerated graphics), the emulated audio controllers, the network adapters, and the USB controllers, each reading guest register writes and DMA descriptors on the host. Code execution lands in the VM process, which runs with the privileges of the user who started the VM. The Guest Additions integration (shared folders, clipboard) adds the HGCM service surface, covered separately.
# the emulated devices visible in the guest (escape surface)
lspci -nn; lsusb
dmesg | grep -iE 'e1000|pcnet|ac97|hda|ohci|ehci|xhci'
Subtopics#
- 3D acceleration: the accelerated-graphics command path.
- Audio devices: the emulated AC97 and HD Audio controllers.
- Network adapters: the e1000, PCnet, and virtio-net models.
- USB controllers: the OHCI, EHCI, and xHCI controllers.