0-day e1k ethernet driver guest to host escape

[n05ph3r42]

e1k driver can be used to escape from guest and execute code in host's ring3.

Explanation & PoC (ru): https://habr.com/post/429004/
video: https://player.vimeo.com/video/299325088?byline=0&badge=0

vulnerable
<= VirtualBox 5.2.20 using e1000 NAT
also all systems using e1k with NAT should be vulnerable too (KVM etc)

[eccerr0r]

Thanks for the report.
ugh... may have to switch all to virtio for all my guests on my KVM when I can... or use 8139 for noncritical...
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

[n05ph3r42]

The bug is already fixed in VBox with latest update. Exploit sample heavily relies on RVA's specific to VBox.
I'm not sure is there exploits in the wild for KVM. It should use different RVA & Write&Read primitives.
E.G. i think you should no worry for your KVM. Skills required to implement exploit for it is high == it have same risk as any other 0day (uncovered).
UPDATED: ive not checked is KVM uses same e1k realization as VBox.

[Ant P.]

This doesn't matter in KVM, it has virtio-net for non-legacy OSes.