Korean Rookie Hackers' Journey: Road to Pwn2Own with a VirtualBox Exploit

Korean Rookie Hackers' Journey: Road to Pwn2Own with a VirtualBox Exploit

Speakers: Han-seo Kim, Student, Azu University (HSPACE (Team PrisonBreak))

Conference: Hexacon

YouTube: https://www.youtube.com/watch?v=BfnQ01BqFHo

Overview

This talk, presented by Han-seo Kim, details the remarkable journey of young Korean hackers, specifically Team PrisonBreak, from foundational cybersecurity education to achieving a significant victory at Pwn2Own. The presentation not only illuminates the unique structure and intensity of Korea's cybersecurity training programs but also provides an in-depth technical breakdown of the VirtualBox vulnerabilities they discovered and exploited to achieve a VM escape to a host operating system. The core of their success lay in identifying and weaponizing an integer overflow within the VGA RectCopy function and an out-of-bounds write in the VirtIO-Net GSO feature, ultimately leading to arbitrary read/write primitives and host code execution.

The significance of this talk extends beyond the technical exploits. It serves as a testament to the efficacy of structured talent development programs like Korea's "Best of the Best" (BoB), which equip ambitious students with the skills and mentorship necessary to tackle complex security challenges. Han-seo Kim, a self-described "newbie" with only two years of experience, exemplifies how early exposure, rigorous training, and collaborative project work can culminate in world-class exploit development, challenging the notion that such achievements are exclusive to seasoned professionals.

For cybersecurity professionals, the talk offers critical insights into the persistent vulnerability landscape of virtualization software. It highlights how seemingly innocuous logic errors, particularly integer overflows and improper bounds checks in device emulation, can be chained to compromise hypervisor integrity. Defenders gain valuable perspectives on potential attack surfaces within virtual environments, while offensive researchers can glean practical exploit development techniques for type-2 hypervisors, including innovative heap spraying and arbitrary read/write primitive construction strategies.

Background

▶ Watch: Talk introduction and agenda overview (0:00)

The journey to Pwn2Own for Team PrisonBreak is deeply rooted in Korea's distinctive cybersecurity education ecosystem. The speaker, Han-seo Kim, began his foray into offensive security as a high school student, a common path for many young Koreans driven by curiosity and a competitive spirit. This early engagement is often nurtured through specialized high schools that integrate computer science and research projects, with achievements in Capture The Flag (CTF) competitions playing a crucial role in university admissions via special talent tracks.

Post-university entry, or even prior, young men in Korea face mandatory military service. While some secure specialized roles in CERT units or cybersecurity positions, these are highly competitive and often do not significantly advance their careers as offensive security researchers, sometimes creating a professional development gap. Amidst this demanding environment, aspiring offensive security researchers often set their sights on the government-supported "Best of the Best" (BoB) training program.

BoB, run by the Ministry of Science and ICT, is a highly selective program with a roughly 10:1 competition ratio for admission. It features four specialized tracks, led by prominent Korean security professionals. Han-seo Kim was admitted to the 13th class, joining the Vulnerability Research track. The program is intensely competitive, structured like a contest with daily public ranking CTFs, advanced computer science, and vulnerability analysis courses, often demanding over 12 hours of study per day for two months. Following this initial training, students embark on a four-month project phase. Team PrisonBreak, focusing on virtualization software, set their ambitious goal: to win the virtualization category at Pwn2Own with a VirtualBox exploit, targeting a Type 2 hypervisor.

A Type 2 hypervisor, such as VirtualBox, operates as an application on top of a host operating system, creating and managing virtual machines within that environment. While designed to strictly isolate the guest from the host, vulnerabilities can lead to a VM escape, granting guest privileges access to the host, potentially resulting in Remote Code Execution (RCE) or arbitrary read/write capabilities on the host. Historically, many such vulnerabilities have been found in the virtual devices emulated by hypervisors, which are software approximations of real hardware drivers (e.g., E1000 for networking, AHCI for storage). These virtual devices can be indirectly triggered by a guest with high privileges through mechanisms like Programmed I/O (PIO) and Memory-Mapped I/O (MMIO) accesses, or via standardized interfaces like VirtIO. When a guest attempts to interact with a virtual device, control is transferred to the hypervisor via a VM exit, handled by virtualization extensions like Intel VT-x or AMD-V (MDB), allowing the host to process the request before returning control to the guest. This indirect communication channel, particularly through virtual devices, became the primary attack surface for Team PrisonBreak's research.

Key Findings

▶ Watch: Forming Team Prison Break for Pwn2Own VirtualBox (4:00)

Team PrisonBreak's research culminated in the discovery and exploitation of two significant vulnerabilities in VirtualBox, one of which was successfully used to win at Pwn2Own. Their primary finding, registered as CVE-2025-53024, was an integer overflow vulnerability residing within the RectCopy function of VirtualBox's VGA emulation logic. This flaw allowed for an out-of-bounds (OOB) read and write primitive, which was crucial for their eventual VM escape.

The root cause of CVE-2025-53024 stemmed from an insufficient validation check during the calculation of UMXOffset, a variable intended to determine the largest offset for read/write operations within the guest's video memory (VRAM). While a final check aimed to ensure UMXOffset did not exceed CBFramebuffer (the video memory size, typically 16MB for default Ubuntu/RedHat guests), the CBScanLine variable, which is guest-controllable and part of the VGAScreenObject structure, was not properly constrained during the initial offset calculation. This oversight allowed UMXOffset to exceed 32 bits, triggering an integer workflow that effectively bypassed the subsequent bounds check. By manipulating guest-controlled registers, the team could craft an UMXOffset that appeared valid due to the overflow, but in reality, pointed to memory outside the intended VRAM boundary. This directly yielded powerful OOB read/write capabilities, allowing them to read data from arbitrary locations outside the guest's VRAM and write arbitrary data to locations on the host's heap.

The second key finding was an out-of-bounds write vulnerability affecting the VirtIO-Net device, specifically within its Generic Segmentation Offload (GSO) feature. This vulnerability arose from a bypass of an initial size validation check. When VirtualBox was configured with a NAT interface, the DRBNATNetworkAllocBufferLookup function performed an initial check to ensure the sum of packet_header_length and segment_size did not exceed DRBNAT_FRAME_SIZE (0x4000). However, if the guest set UA_TYPE to IPv4, the cbHeaderTotal variable was recalculated using a guest-controlled checksum. This recalculation effectively skipped the original bounds revalidation. Consequently, while a heap buffer of 0x4000 bytes was allocated, a subsequent call to PDMNetGSOCalculateSegment would recalculate the length using the guest-controlled cbHeaderTotal, allowing cbHeader and cbPayload to exceed the allocated 0x4000-byte buffer, leading to an OOB write. Although this VirtIO-Net vulnerability was initially planned for Pwn2Own, it was patched by Oracle before the rescheduled competition, necessitating a pivot to the VGA RectCopy exploit.

These findings underscore the critical importance of meticulous bounds checking and integer handling in low-level device emulation, especially where guest-controlled inputs directly influence memory access calculations. Both vulnerabilities demonstrated how subtle logic flaws in complex virtualization software can be leveraged to compromise the hypervisor's isolation boundaries.

Technical Deep Dive

▶ Watch: VM escape attack vectors, focusing on virtual devices (6:00)

The core of Team PrisonBreak's Pwn2Own exploit centered on CVE-2025-53024, an integer overflow in the VGA RectCopy function of VirtualBox, leading to a powerful out-of-bounds (OOB) read and write primitive. This vulnerability was triggered by manipulating guest-controlled VGA registers to influence the calculation of UMXOffset, a critical variable that determines the extent of memory access during a copy operation within the virtual graphics memory.

The RectCopy function is designed to copy rectangular pixel areas within the guest VM's video memory (VRAM). This process involves placing a command ID and coordinate values into a FIFO queue and then writing to a sync MMIO register to request processing. The UMXOffset variable, crucial for memory access, is calculated based on six guest-controllable variables, including CBScanLine and CBPixel, which are members of the VGAScreenObject structure. The CBPitch variable, also part of this structure, can be set by the DefineScreen command using guest-supplied width and height values.

The vulnerability manifested because, while a final validation check existed to ensure UMXOffset was less than CBFramebuffer (the VRAM size, typically 16MB or 0x1000000 in hex for Ubuntu/RedHat guests), the CBScanLine variable was not adequately constrained during the initial offset calculation. This allowed for an integer overflow to occur within UMXOffset, causing its value to wrap around and appear to be within the valid range, thus bypassing the final UMXOffset < CBFramebuffer check. By crafting specific guest-controlled values for CBScanLine and other parameters, the team could make UMXOffset point to locations far beyond the VRAM boundary, effectively enabling an OOB read/write.

With the OOB read/write primitive in hand, the next challenge was to achieve reliable exploitation on a Windows host from a RedHat Linux guest. The primary hurdle was the large offset of the OOB access, potentially gigabytes away from the heap memory. This necessitated a massive heap allocation strategy to ensure that a suitable target structure would reside at a predictable offset. The team identified Guest Memory Region (GMR) structures as the optimal candidate.

GMRs are allocated by the guest using the VBoxGstCMD_DEFINE_GMR2 and VBoxGstCMD_REMAP_GMR2 commands. These commands allow the guest to define and remap memory regions that the hypervisor manages. Critically, GMRs offered several advantages:

1. Large-scale Allocation: The guest could create up to 0x2000 (8192) heap chunks, each with a maximum size of 0x100000 (1MB). This enabled a total heap allocation exceeding 4GB, sufficient to cover the vast OOB offset range.
2. Heap Randomness Reduction: Allocating chunks larger than 0x4000 bytes helped reduce heap randomness and avoid Windows' Low Fragmentation Heap (LFH) guard pages, which could complicate exploitation.
3. Guest-Controllable Values: GMRs allowed the insertion of arbitrary, guest-controlled values into their structures. This was paramount for heap spraying. By filling the GMRs with unique markers, the team could accurately identify which GMR was hit by the OOB write based on the overwritten marker.

Once a GMR was identified as being at the OOB offset, it was freed. The next step involved planting a malicious structure in its place. The chosen target was the USB Device Structure (URB). URBs are created when a USB device is generated from the guest. They are particularly valuable because they contain crucial addresses needed for exploitation, such as the base address of BoxDD.DLL and the VRAM address. Furthermore, URBs are structured as a linked list, which can be leveraged for more powerful arbitrary read/write primitives.

The team first achieved an 8-byte arbitrary write by using the OOB write to overwrite the next and prev pointers of a URB node, enabling an unsafe unlink attack. To obtain a more flexible arbitrary read/write primitive of variable size, they targeted the Virtual USB Root Hub structure. Specifically, they overwrote the address of the APID (Asynchronous Packet ID) within this structure with the address of a fake structure that they had prepared in an accessible VRAM location. This fake structure contained a USB Control Pipe. By manipulating this control pipe, which now pointed to their controlled VRAM location, they could achieve arbitrary read/write operations of any desired size.

Finally, for code execution, the team again utilized the USB Root Hub structure. This structure contains a function pointer named hSnipper. If hSnipper is not null, the snipperRecordEvent function is invoked. By using their arbitrary write primitive to overwrite the hSnipper pointer with the address of the WinExec function (a Windows API function capable of executing commands), they could trigger WinExec on the host, ultimately executing calculator.exe. This demonstrated a full VM escape to host code execution.

The speaker noted that while they initially aimed for more sophisticated RCE techniques like JOP (Jump-Oriented Programming) or ROP (Return-Oriented Programming), time constraints and the difficulty of bypassing Control Flow Integrity (CFI) within the Pwn2Own deadline led them to opt for the simpler, yet effective, WinExec approach via function pointer overwrite.

Demo / Proof of Concept

▶ Watch: Efficient device emulation with VirtIO interface (7:40)

The team's successful exploitation was demonstrated in a live proof of concept video. The target environment consisted of:

• VirtualBox Version: 7.1.8 (with default settings)
• Guest OS: RedHat Linux
• Host OS: Windows 11

The demo began with the RedHat Linux guest operating normally. Following the execution of their exploit, the guest screen immediately went "dead" or became corrupted. This visual disruption was an expected side effect, directly attributable to the nature of the exploited VGA vulnerability, which manipulates the virtual graphics memory. Despite the guest screen instability, the critical outcome was observed on the host system: the Windows 11 host successfully launched calculator.exe, unequivocally proving the VM escape and host code execution. This demonstration validated their ability to achieve a reliable exploit with over 90% success rate, even after the initial VirtIO-Net vulnerability was patched and the guest OS changed for Pwn2Own.

Defensive Implications

▶ Watch: Example: VGA rectCopy function in VirtualBox (9:00)

The vulnerabilities and exploitation techniques presented in this talk offer several critical defensive implications for organizations utilizing virtualization platforms, particularly VirtualBox.

1. Prioritize Hypervisor Updates: The most immediate and crucial defense is to keep virtualization software, including VirtualBox, consistently updated to the latest stable versions. The fact that Team PrisonBreak's initial VirtIO-Net vulnerability was patched before Pwn2Own underscores the importance of prompt patching cycles. Organizations should have robust patch management policies for hypervisors, treating them with the same, if not greater, criticality as operating systems.

1. Scrutinize Virtual Device Emulation: Both vulnerabilities exploited were found in virtual device emulation (VGA and VirtIO-Net). This highlights a persistent and high-risk attack surface. Defenders should be aware that these emulated components, which handle complex interactions between guest and host, are prime targets for integer overflows, out-of-bounds accesses, and other memory corruption bugs. While direct mitigation is difficult without source code access, understanding this attack vector can inform threat modeling.

1. Implement Least Privilege for Virtual Machines: While VM escape aims to bypass guest isolation, restricting guest privileges can still reduce the attack surface. For example, disabling unnecessary virtual devices or features (like virtual USB, serial ports, or advanced graphics features if not strictly required) can eliminate potential vulnerability points.

1. Monitor Host System for Anomalous Behavior: A VM escape, by definition, results in code execution on the host. Organizations should deploy and configure Endpoint Detection and Response (EDR) solutions on host systems running VMs. These EDRs should be tuned to detect unusual process spawns (e.g., calculator.exe from a hypervisor process), unexpected network connections originating from the hypervisor, or unauthorized file system modifications from processes associated with the virtualization software.

1. Consider Host Hardening: The exploitation relied on finding specific structures on the host's heap and overwriting function pointers. Host hardening techniques, such as Control Flow Integrity (CFI), Data Execution Prevention (DEP), and Address Space Layout Randomization (ASLR), are designed to make such exploits more difficult. While the team bypassed some of these (e.g., ASLR via information leak), robust CFI implementations could have prevented the simple WinExec function pointer overwrite. Organizations should ensure their host OSes are configured with these mitigations enabled and updated.

1. Network Segmentation for VM Hosts: Isolate VM host servers on dedicated network segments. This limits the lateral movement capabilities of an attacker who successfully achieves a VM escape, preventing them from immediately accessing critical internal resources.

1. Review VirtualBox Configuration: While the team used default settings for Pwn2Own, organizations should review and harden VirtualBox configurations. This includes ensuring that guest additions are from trusted sources and kept updated, and carefully evaluating the necessity of features like shared folders or clipboard synchronization, which can introduce additional attack vectors.

1. Understand the Threat of Integer Overflows: The primary vulnerability was an integer overflow. These bugs are common and often overlooked. Developers of virtualization software must prioritize meticulous validation of all guest-controlled inputs that contribute to size or offset calculations to prevent such issues.

By adopting a multi-layered defense strategy that combines timely patching, configuration hardening, robust monitoring, and an understanding of common hypervisor attack vectors, organizations can significantly reduce their exposure to VM escape vulnerabilities.

Key Takeaways

• Virtualization Software Remains a Critical Attack Surface: Complex device emulation logic in hypervisors like VirtualBox is prone to subtle bugs (e.g., integer overflows, improper bounds checks) that can lead to VM escape.
• Integer Overflows are Potent Primitives: The core vulnerability, CVE-2025-53024, an integer overflow in the VGA RectCopy function, demonstrates how such flaws can be weaponized to achieve powerful out-of-bounds read/write capabilities.
• Strategic Heap Spraying is Key for Large Offsets: Exploiting OOB vulnerabilities with large, unpredictable offsets (e.g., 4GB away from heap) requires sophisticated heap spraying techniques, as exemplified by the use of Guest Memory Region (GMR) structures.
• Chaining Primitives for Full Exploitation: Achieving VM escape involves chaining multiple primitives: an OOB read/write for information leak (heap/module bases), then leveraging existing structures (like URB and USB Root Hub) to gain arbitrary read/write, and finally overwriting function pointers for code execution.
• Korean Cybersecurity Education is World-Class: Programs like "Best of the Best" (BoB) provide intensive, project-based training that enables young, relatively inexperienced hackers to achieve significant feats like winning Pwn2Own.
• Continuous Patching is Essential: Even well-researched vulnerabilities can be patched by vendors before competition or deployment, emphasizing the need for constant monitoring and adaptation in exploit development, as seen with the VirtIO-Net vulnerability.

About the Speaker(s)

Han-seo Kim is a student at Azu University in Korea and a member of HSPACE (Team PrisonBreak). Despite describing himself as a "newbie" with only two years of experience in offensive security, he demonstrated exceptional skill and dedication by leading his team to a victory at Pwn2Own. His journey, as detailed in the talk, highlights his participation in Korea's "Best of the Best" (BoB) program, where he was admitted to the 13th class in the Vulnerability Research track. His success at Pwn2Own, becoming the first team from the BoB program to win, underscores the effectiveness of Korea's specialized cybersecurity education system and his personal aptitude for complex vulnerability research and exploit development.