Thinking Outside The Box [dusted off draft from 2017]

## Executive summary The report analyzes a 2017-era vulnerability in VirtualBox's Slirp-based NAT implementation where an attacker-controlled IP packet length and inline heap metadata allow out-of-bounds reads and header corruption in the packet allocator. The author details reliable methods to leak heap and GOT contents, convert the flaw into a write primitive (via calling memcpy through a corrupted zone->pfFini), and chain this to compute and invoke system() on the host, enabling guest-to-host code execution.