26
Coverage of 26 from the conference program.
Summary
VirtualBox SVGA Attack Surface
Devcore researchers Nini Chen and Xiaobai present "Pedal to the Metal," motivated by Pwn2Own VirtualBox research after that category was dropped. They focus on VMware SVGA-compatible graphics virtualization in VirtualBox, where guest MOBs (memory objects) pass through PMIO/MMIO to a shared DirectX backend on Windows, Linux, and macOS.
MOB Binding Mechanics
Guests bind MOBs to DirectX components via commands like set COT table and DX bind shader. VirtualBox tracks bindings in a VMSVGA 3D DX context array of cot mobs. Shader binding validates bytecode before recording MOB IDs in shader entries.
Lifetime Bugs and Impact
The speakers show MOBs can be shared across components without enforcement. Failed shader validation frees GPU buffers but leaves dangling cot pointers—a use-after-free. Destroying a MOB while components still reference it creates one-directional binding bugs. Graphic flaws may affect many guest/host combinations.
