CVE-2014-0983

Oracle VirtualBox < 4.3.8 Local Guest-to-Host RCE via 3D Acceleration

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2014-0983. PoCs published by Core Security, Francisco Falcon, Florian Ledoux, juan vazquez, including Metasploit module exploits/windows/local/virtual_box_opengl_escape.

AI-analyzed exploit summary This advisory details multiple memory corruption vulnerabilities in Oracle VirtualBox's 3D Acceleration feature, specifically in the Chromium library's handling of OpenGL commands. It provides a technical breakdown of three CVEs (CVE-2014-0981, CVE-2014-0982, CVE-2014-0983) involving improper validation of array indices, leading to arbitrary memory write primitives and potential guest-to-host escape.

Description

Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.

Exploits (3)

exploitdb WRITEUP VERIFIED
by Core Security · textdosmultiple
https://www.exploit-db.com/exploits/32208

This advisory details multiple memory corruption vulnerabilities in Oracle VirtualBox's 3D Acceleration feature, specifically in the Chromium library's handling of OpenGL commands. It provides a technical breakdown of three CVEs (CVE-2014-0981, CVE-2014-0982, CVE-2014-0983) involving improper validation of array indices, leading to arbitrary memory write primitives and potential guest-to-host escape.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Oracle VirtualBox v4.2.20 and earlier, v4.3.6 and earlier
No auth needed
Prerequisites: 3D Acceleration enabled in VirtualBox · Guest OS with OpenGL application execution capabilities
devstral-2 · analyzed Feb 18, 2026 Full analysis →
exploitdb WORKING POC
rubyremotewindows_x86-64
https://www.exploit-db.com/exploits/34334

This Metasploit module exploits a memory corruption vulnerability in VirtualBox's 3D acceleration feature (CVE-2014-0983) to escape from a guest VM to the host. It uses a sequence of crafted HGCM messages to trigger an out-of-bounds array access and execute a ROP chain for privilege escalation.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Oracle VirtualBox 4.3.6
No auth needed
Prerequisites: Guest VM with 3D acceleration enabled · Meterpreter session on the guest
devstral-2 · analyzed Feb 19, 2026 Full analysis →
metasploit WORKING POC NORMAL
by Francisco Falcon, Florian Ledoux, juan vazquez · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/virtual_box_opengl_escape.rb

This Metasploit module exploits a memory corruption vulnerability in VirtualBox's 3D acceleration support (CVE-2014-0983) to escape from a guest VM to the host. It uses a sequence of crafted OpenGL rendering messages to trigger an out-of-bounds array access, leading to arbitrary code execution on the host system.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Oracle VirtualBox 4.3.6 (and likely other versions)
No auth needed
Prerequisites: VirtualBox with 3D acceleration enabled · Guest VM with access to the VBoxGuest device
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (9)

Core 9
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/32208
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201612-27
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/57384
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/531418/100/0/threaded
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2904
Various Sources x_refsource_confirm
https://www.virtualbox.org/changeset/50441/vbox
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Mar/95

Scores

EPSS 0.1461
EPSS Percentile 94.6%

Details

CWE
CWE-399
Status published
Products (15)
oracle/vm_virtualbox 4.2.0
oracle/vm_virtualbox 4.2.2
oracle/vm_virtualbox 4.2.4
oracle/vm_virtualbox 4.2.6
oracle/vm_virtualbox 4.2.8
oracle/vm_virtualbox 4.2.10
oracle/vm_virtualbox 4.2.12
oracle/vm_virtualbox 4.2.14
oracle/vm_virtualbox 4.2.16
oracle/vm_virtualbox 4.2.18
... and 5 more
Published Mar 31, 2014
Tracked Since Feb 18, 2026