# What Is the Purpose of stage2.c in the QEMU CXL Exploit?

> Discover the purpose of stage2.c in the QEMU CXL exploit. This code manipulates the CXL Type-3 mailbox interface to trigger host memory corruption and achieve arbitrary code execution.

- Repository: [bikini/exploitarium](https://github.com/bikini/exploitarium)
- Tags: deep-dive
- Published: 2026-09-07

---

**[`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c) implements the second-stage payload that executes inside the QEMU guest to manipulate the CXL Type-3 mailbox interface, trigger memory corruption vulnerabilities in the host's mailbox handler, and achieve arbitrary code execution on the hypervisor host.**

The `bikini/exploitarium` repository contains a proof-of-concept exploit targeting QEMU's CXL (Compute Express Link) Type-3 device emulation. Located at [`qemu-cxl-type3-mailbox-escape-poc/stage2.c`](https://github.com/bikini/exploitarium/blob/main/qemu-cxl-type3-mailbox-escape-poc/stage2.c), this source file defines the privileged payload logic that transforms an initial guest foothold into full host system compromise.

## The Two-Stage Exploit Architecture

The proof-of-concept operates through a coordinated two-stage attack sequence designed to escape the virtual machine sandbox. **Stage 1** establishes the initial execution environment using `boot.asm` and the linker script `stage2.ld`, which load the payload into specific virtual addresses within the guest's memory space. **Stage 2** transfers control to [`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c), where the core vulnerability exploitation logic executes to compromise the host hypervisor.

According to the repository structure, `boot.asm` serves as a minimal boot loader that prepares the execution context, while `stage2.ld` ensures the payload resides at the precise memory offsets required for successful exploitation.

## Core Functionality of stage2.c

The [`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c) file contains the malicious logic that interacts directly with QEMU's virtual CXL hardware. Its primary objective is to abuse the Type-3 mailbox handling code to perform arbitrary memory operations on the host.

### Interfacing with the CXL Mailbox Device

Upon execution, the payload opens the CXL Type-3 mailbox device node exposed to the guest. This interface typically appears as `/dev/cxl/mtype3` within the virtualized environment, providing a communication channel to the emulated hardware's mailbox registers.

### Crafting Malicious Mailbox Requests

The exploit constructs malformed mailbox request structures designed to trigger logic errors in QEMU's CXL mailbox handler. These requests include:

- **Attacker-controlled opcodes** that force the vulnerable code paths
- **Payload arrays** containing target addresses and shellcode pointers
- **Length miscalculations** that enable out-of-bounds write operations

The following code illustrates the operations performed in [`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c):

```c
/* Open the CXL mailbox device */
int fd = open("/dev/cxl/mtype3", O_RDWR);
if (fd < 0) {
    perror("open");
    exit(1);
}

/* Construct a malicious mailbox request */
struct cxl_mailbox_req {
    uint64_t opcode;      /* opcode that triggers the bug */
    uint64_t payload[6];  /* attacker‑controlled data */
} req;

/* Fill the request with crafted values that cause
   an out‑of‑bounds write in the host’s mailbox handler */
req.opcode  = 0xdeadbeef;           /* vulnerable opcode */
req.payload[0] = TARGET_ADDRESS;    /* address we want to overwrite */
req.payload[1] = SHELLCODE_ADDRESS; /* address of our shellcode */

/* Send the request */
if (write(fd, &req, sizeof(req)) != sizeof(req)) {
    perror("write");
    exit(1);
}

/* At this point the host’s memory is corrupted and our
   shellcode is executed, giving us a root shell. */

```

### Achieving Host Memory Corruption and Privilege Escalation

When the malicious request reaches QEMU's mailbox handler, the vulnerable Type-3 implementation performs an out-of-bounds write to host memory. This corruption allows the attacker to overwrite function pointers or critical data structures, ultimately redirecting execution to attacker-controlled shellcode. Successful exploitation yields a root shell on the host system, completely escaping the virtual machine boundaries.

## Supporting Components in the Repository

The [`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c) payload does not operate in isolation. Several auxiliary files in `qemu-cxl-type3-mailbox-escape-poc/` complete the exploit chain:

- **`boot.asm`** – A minimal boot loader written in assembly that initializes the guest environment and transfers control to the second-stage payload.
- **`stage2.ld`** – A linker script that positions the compiled payload at specific virtual addresses required for the exploit's memory layout constraints.
- **[`run.sh`](https://github.com/bikini/exploitarium/blob/main/run.sh)** – An automation script that compiles the PoC components, configures QEMU with the necessary CXL device parameters, and launches the exploit sequence.
- **[`README.md`](https://github.com/bikini/exploitarium/blob/main/README.md)** – Documentation providing setup instructions, vulnerability details, and architectural overview of the attack.

## Summary

- **[`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c)** implements the second-stage payload that executes within the QEMU guest to attack the host hypervisor.
- The payload opens the virtual CXL Type-3 mailbox device at `/dev/cxl/mtype3` to communicate with the emulated hardware.
- It crafts malformed mailbox requests with specific opcodes and payload values to trigger out-of-bounds writes in QEMU's mailbox handler.
- Successful exploitation enables arbitrary host memory read/write capabilities and ultimately achieves root-level code execution outside the virtual machine.
- The file works in conjunction with `boot.asm`, `stage2.ld`, and [`run.sh`](https://github.com/bikini/exploitarium/blob/main/run.sh) to form a complete VM escape proof-of-concept.

## Frequently Asked Questions

### What does stage2.c do in the QEMU CXL exploit?

[`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c) contains the second-stage exploit payload that runs inside the guest virtual machine. It opens the CXL mailbox device, constructs malicious requests that exploit logic errors in QEMU's Type-3 mailbox handling code, and triggers memory corruption that allows the attacker to execute arbitrary code on the host system with root privileges.

### How does stage2.c interact with the CXL mailbox device?

The code opens the device node at `/dev/cxl/mtype3` using standard file operations. It then creates a `cxl_mailbox_req` structure containing attacker-controlled opcodes and payload data, which it transmits via `write()` system calls. These malformed requests trigger vulnerabilities in the host-side mailbox handler when processed by QEMU's CXL emulation layer.

### What vulnerability does stage2.c exploit in QEMU?

The payload targets logic errors in the CXL Type-3 mailbox handling implementation. By sending specific opcode values such as `0xdeadbeef` with carefully crafted payload arrays, it induces out-of-bounds write conditions in the host's memory space. This allows overwriting of function pointers or injection of shellcode, resulting in a complete VM escape.

### What files are required to run the stage2.c payload?

The complete exploit requires four primary components from the `qemu-cxl-type3-mailbox-escape-poc/` directory: `boot.asm` to establish the initial execution context, `stage2.ld` to properly position the payload in memory, [`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c) containing the actual exploit logic, and [`run.sh`](https://github.com/bikini/exploitarium/blob/main/run.sh) to automate the build and execution process against a vulnerable QEMU instance.