Bypassing Virtual Box Process Hardening on Windows
Summary: Project Zero's James Forshaw described three now-fixed methods for bypassing Oracle VirtualBox's Windows process hardening and injecting arbitrary code into its protected processes. The hardening uses kernel callbacks to limit handle access and user-mode hooks on LdrLoadDll, NtCreateSection and LdrRegisterDllNotification to verify DLL signatures, and the first bug, fixed as CVE-2017-3563 in VirtualBox 5.0.38/5.1.20, exploited COM registration in the user's registry hive being checked before the local machine hive.
What you should know: VirtualBox's hardening exists because access to its kernel driver is a route to kernel or system privileges, and the documented bypass needs neither administrator rights nor a code signing certificate. The protection also concedes it cannot stop an administrator, who can install a local machine Trusted Root CA certificate, sign a DLL, set its owner and force it into the verified process.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026