What Is the Purpose of stage2.c in the QEMU CXL Exploit?

stage2.c implements the second-stage payload that executes inside the QEMU guest to manipulate the CXL Type-3 mailbox interface, trigger memory corruption vulnerabilities in the host's mailbox handler, and achieve arbitrary code execution on the hypervisor host.

The bikini/exploitarium repository contains a proof-of-concept exploit targeting QEMU's CXL (Compute Express Link) Type-3 device emulation. Located at qemu-cxl-type3-mailbox-escape-poc/stage2.c, this source file defines the privileged payload logic that transforms an initial guest foothold into full host system compromise.

The Two-Stage Exploit Architecture

The proof-of-concept operates through a coordinated two-stage attack sequence designed to escape the virtual machine sandbox. Stage 1 establishes the initial execution environment using boot.asm and the linker script stage2.ld, which load the payload into specific virtual addresses within the guest's memory space. Stage 2 transfers control to stage2.c, where the core vulnerability exploitation logic executes to compromise the host hypervisor.

According to the repository structure, boot.asm serves as a minimal boot loader that prepares the execution context, while stage2.ld ensures the payload resides at the precise memory offsets required for successful exploitation.

Core Functionality of stage2.c

The stage2.c file contains the malicious logic that interacts directly with QEMU's virtual CXL hardware. Its primary objective is to abuse the Type-3 mailbox handling code to perform arbitrary memory operations on the host.

Interfacing with the CXL Mailbox Device

Upon execution, the payload opens the CXL Type-3 mailbox device node exposed to the guest. This interface typically appears as /dev/cxl/mtype3 within the virtualized environment, providing a communication channel to the emulated hardware's mailbox registers.

Crafting Malicious Mailbox Requests

The exploit constructs malformed mailbox request structures designed to trigger logic errors in QEMU's CXL mailbox handler. These requests include:

• Attacker-controlled opcodes that force the vulnerable code paths
• Payload arrays containing target addresses and shellcode pointers
• Length miscalculations that enable out-of-bounds write operations

The following code illustrates the operations performed in stage2.c:

/* Open the CXL mailbox device */
int fd = open("/dev/cxl/mtype3", O_RDWR);
if (fd < 0) {
    perror("open");
    exit(1);
}

/* Construct a malicious mailbox request */
struct cxl_mailbox_req {
    uint64_t opcode;      /* opcode that triggers the bug */
    uint64_t payload[6];  /* attacker‑controlled data */
} req;

/* Fill the request with crafted values that cause
   an out‑of‑bounds write in the host’s mailbox handler */
req.opcode  = 0xdeadbeef;           /* vulnerable opcode */
req.payload[0] = TARGET_ADDRESS;    /* address we want to overwrite */
req.payload[1] = SHELLCODE_ADDRESS; /* address of our shellcode */

/* Send the request */
if (write(fd, &req, sizeof(req)) != sizeof(req)) {
    perror("write");
    exit(1);
}

/* At this point the host’s memory is corrupted and our
   shellcode is executed, giving us a root shell. */

Achieving Host Memory Corruption and Privilege Escalation

When the malicious request reaches QEMU's mailbox handler, the vulnerable Type-3 implementation performs an out-of-bounds write to host memory. This corruption allows the attacker to overwrite function pointers or critical data structures, ultimately redirecting execution to attacker-controlled shellcode. Successful exploitation yields a root shell on the host system, completely escaping the virtual machine boundaries.

Supporting Components in the Repository

The stage2.c payload does not operate in isolation. Several auxiliary files in qemu-cxl-type3-mailbox-escape-poc/ complete the exploit chain:

• boot.asm – A minimal boot loader written in assembly that initializes the guest environment and transfers control to the second-stage payload.
• stage2.ld – A linker script that positions the compiled payload at specific virtual addresses required for the exploit's memory layout constraints.
• run.sh – An automation script that compiles the PoC components, configures QEMU with the necessary CXL device parameters, and launches the exploit sequence.
• README.md – Documentation providing setup instructions, vulnerability details, and architectural overview of the attack.

Summary

• stage2.c implements the second-stage payload that executes within the QEMU guest to attack the host hypervisor.
• The payload opens the virtual CXL Type-3 mailbox device at /dev/cxl/mtype3 to communicate with the emulated hardware.
• It crafts malformed mailbox requests with specific opcodes and payload values to trigger out-of-bounds writes in QEMU's mailbox handler.
• Successful exploitation enables arbitrary host memory read/write capabilities and ultimately achieves root-level code execution outside the virtual machine.
• The file works in conjunction with boot.asm, stage2.ld, and run.sh to form a complete VM escape proof-of-concept.

Frequently Asked Questions

What does stage2.c do in the QEMU CXL exploit?

stage2.c contains the second-stage exploit payload that runs inside the guest virtual machine. It opens the CXL mailbox device, constructs malicious requests that exploit logic errors in QEMU's Type-3 mailbox handling code, and triggers memory corruption that allows the attacker to execute arbitrary code on the host system with root privileges.

How does stage2.c interact with the CXL mailbox device?

The code opens the device node at /dev/cxl/mtype3 using standard file operations. It then creates a cxl_mailbox_req structure containing attacker-controlled opcodes and payload data, which it transmits via write() system calls. These malformed requests trigger vulnerabilities in the host-side mailbox handler when processed by QEMU's CXL emulation layer.

What vulnerability does stage2.c exploit in QEMU?

The payload targets logic errors in the CXL Type-3 mailbox handling implementation. By sending specific opcode values such as 0xdeadbeef with carefully crafted payload arrays, it induces out-of-bounds write conditions in the host's memory space. This allows overwriting of function pointers or injection of shellcode, resulting in a complete VM escape.

What files are required to run the stage2.c payload?

The complete exploit requires four primary components from the qemu-cxl-type3-mailbox-escape-poc/ directory: boot.asm to establish the initial execution context, stage2.ld to properly position the payload in memory, stage2.c containing the actual exploit logic, and run.sh to automate the build and execution process against a vulnerable QEMU instance.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}