VIR Vulnerability Intelligence Relay

CVE-2014-0983

medium
Published 2014-03-31 · Modified 2026-05-06
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
7.9

Description

Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-34334 remote windows_x86-64 verified
Metasploit · 2014-08-14

Oracle VM VirtualBox 4.3.6 - 3D Acceleration Virtual Machine Escape (Metasploit)

Source code queued for fetch — refresh in a moment.
EDB-32208 dos multiple verified
Core Security · 2014-03-12

Oracle VM VirtualBox - 3D Acceleration Multiple Vulnerabilities

Source code queued for fetch — refresh in a moment.

Metasploit modules

exploit_windows/local/virtual_box_opengl_escape rank 200
VirtualBox 3D Acceleration Virtual Machine Escape
Source fetch failed: fetch_error — view the original via the link above.

OS impact
debian Debian Fixed 1 release
VersionStatusFixed in
sid Fixed 4.3.10-dfsg-1

Application impact
VendorProductVersionsFixed
oracle oraclevm_virtualbox4.2.0
oracle oraclevm_virtualbox4.2.2
oracle oraclevm_virtualbox4.2.4
oracle oraclevm_virtualbox4.2.6
oracle oraclevm_virtualbox4.2.8
oracle oraclevm_virtualbox4.2.10
oracle oraclevm_virtualbox4.2.12
oracle oraclevm_virtualbox4.2.14
oracle oraclevm_virtualbox4.2.16
oracle oraclevm_virtualbox4.2.18
oracle oraclevm_virtualbox4.2.20
oracle oraclevm_virtualbox4.3.0
oracle oraclevm_virtualbox4.3.2
oracle oraclevm_virtualbox4.3.4
oracle oraclevm_virtualbox4.3.6

References

CWEs

CWE-399

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.