<story><title>VirtualBox E1000 Guest-to-Host Escape</title><url>https://github.com/MorteNoir1/virtualbox_e1000_0day</url></story><parent_chain></parent_chain><comment><author>metafunctor</author><text>This [1] gives a little more background.  The same security researcher found another vulnerability in VirtualBox earlier this year, and didn&amp;#x27;t have a great experience with Oracle:&lt;p&gt;“We reported this vulnerability to Oracle, the latest update from them is that they are still looking into it, while in fact the latest version of Oracle VirtualBox version 5.2.18 has silently introduced a patch without giving credit or mentioning of the vulnerability report.”&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blogs.securiteam.com&amp;#x2F;index.php&amp;#x2F;archives&amp;#x2F;3736&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blogs.securiteam.com&amp;#x2F;index.php&amp;#x2F;archives&amp;#x2F;3736&lt;/a&gt;</text></comment>
<story><title>VirtualBox E1000 Guest-to-Host Escape</title><url>https://github.com/MorteNoir1/virtualbox_e1000_0day</url></story><parent_chain></parent_chain><comment><author>cantrevealname</author><text>I think the author brings up a good point about so-called &amp;quot;responsible disclosure&amp;quot; (a self-serving term by the vendors).&lt;p&gt;I&amp;#x27;m paraphrasing his 3 reasons for disclosing immediately:&lt;p&gt;1. It&amp;#x27;s unacceptable to wait half a year until a vulnerability is patched.&lt;p&gt;2. Bug bounties are riddled with tricks to delay you, shenanigans as to whether they&amp;#x27;ll pay you or not, and games to low ball the price.&lt;p&gt;3. It&amp;#x27;s arrogant to wait months while meanwhile preparing for a big boastful disclosure.&lt;p&gt;I&amp;#x27;m thinking that we could add to this list as follows:&lt;p&gt;4. The vulnerability might already be well-known and being used by black hats and secret government agencies. Releasing the details immediately puts all of us on an equal footing.&lt;p&gt;5. Punish the vendors for having such awful security. Just the other day, HN had an article[1] about Crucial SSDs that encrypt the drive with a key that doesn&amp;#x27;t depend on the password; you can decrypt the drive without the password just by patching the firmware. Is Crucial going to get punished for such an outrageous lie about their encryption?  The marketplace mechanisms that force vendors to pay proper attention to security are trust in the brand, independent security reviews (thank you security researchers!), government regulation (no thank you), and &lt;i&gt;immediately&lt;/i&gt; naming and shaming them without giving them time to cover it up or downplay it.&lt;p&gt;6. Punish the users for not demanding higher security. Of course, we could suffer as result, but it&amp;#x27;s not the security researcher who caused the bug and it&amp;#x27;s not the security researcher who would be exploiting it. There needs to be demand from users for higher security in their purchases.&lt;p&gt;7. We get to see all the details if the vulnerability is disclosed immediately. If the vulnerability is disclosed after &amp;quot;responsible disclosure&amp;quot;, plenty of times you don&amp;#x27;t get the raw details. I wouldn&amp;#x27;t be surprised if many security researchers are signed to NDAs (or simply threatened by lawyers), so we don&amp;#x27;t hear about the bugs &lt;i&gt;at all&lt;/i&gt;. Having the full details published immediately advances our knowledge in the security field more than a partial disclosure months later (or a non-disclosure).&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=18382975&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=18382975&lt;/a&gt;</text></comment>