# Where to Find the QEMU CXL Type-3 Mailbox Escape PoC: Complete Exploitarium Guide

> Find the QEMU CXL Type-3 Mailbox Escape PoC in the bikini/exploitarium GitHub repository. Get the complete exploitarium guide and explore the vulnerability.

- Repository: [bikini/exploitarium](https://github.com/bikini/exploitarium)
- Tags: how-to-guide
- Published: 2026-09-07

---

**The QEMU CXL Type-3 Mailbox Escape proof-of-concept is located in the `qemu-cxl-type3-mailbox-escape-poc` directory of the Exploitarium repository on GitHub.**

The **Exploitarium** repository by bikini hosts a reproducible memory-corruption exploit chain targeting QEMU's CXL Type-3 mailbox implementation. This PoC demonstrates a guest-to-host escape vulnerability using a crafted BIOS image and PCI configuration space manipulation.

## Repository Location and Directory Structure

The PoC resides in a dedicated subdirectory within the main Exploitarium repository.

### Main Directory Path

All source code, build scripts, and documentation are stored under:

```

exploitarium/qemu-cxl-type3-mailbox-escape-poc/

```

The full repository URL is `github.com/bikini/exploitarium`, with the PoC accessible directly via the path `qemu-cxl-type3-mailbox-escape-poc/`.

### Core Source Files

The directory contains seven primary files that constitute the complete exploit environment:

- **[`README.md`](https://github.com/bikini/exploitarium/blob/main/README.md)** – Comprehensive documentation covering build requirements, exploit flow, and execution instructions
- **[`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c)** – Freestanding 32-bit guest code that drives PCI config space and the CXL mailbox interface
- **`stage2.ld`** – Linker script defining the flat protected-mode memory layout for the stage2 payload
- **`boot.asm`** – 16-bit real-mode loader that reads the protected-mode stage from the floppy image
- **[`build.sh`](https://github.com/bikini/exploitarium/blob/main/build.sh)** – Shell script that compiles sources and produces the `poc.img` binary
- **[`run.sh`](https://github.com/bikini/exploitarium/blob/main/run.sh)** – Launch wrapper that configures QEMU with CXL Type-3 support and executes the exploit
- **`poc.img`** – Pre-built BIOS floppy image ready for immediate testing

## Key Components of the Exploit Chain

The PoC implements a multi-stage boot process to establish the guest environment and trigger the vulnerability.

### stage2.c - The Memory Corruption Payload

The file [`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c) contains the core exploit logic. This freestanding C code runs in 32-bit protected mode and performs the following operations:

1. Initializes PCI configuration space access
2. Communicates with the CXL Type-3 mailbox interface
3. Leaks host heap pointers through the vulnerability
4. Crafts forged memory objects to achieve arbitrary code execution
5. Invokes the host's `system()` function to demonstrate the escape

According to the source analysis, successful execution creates a marker file at `/tmp/qemu_cxl_escape_marker` confirming the guest payload escaped to the host environment.

### Build and Execution Scripts

The **[`build.sh`](https://github.com/bikini/exploitarium/blob/main/build.sh)** script automates compilation of `boot.asm`, [`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c), and linking via `stage2.ld` to regenerate `poc.img`. The **[`run.sh`](https://github.com/bikini/exploitarium/blob/main/run.sh)** script handles QEMU orchestration, configuring a Q35 machine with CXL Type-3 enabled, attaching volatile memory and dynamic-capacity regions, and managing execution timeouts.

## Running the QEMU CXL Type-3 Mailbox Escape PoC

Clone the repository and execute the following commands to reproduce the vulnerability:

```bash

# Clone the Exploitarium repository

git clone https://github.com/bikini/exploitarium.git
cd exploitarium/qemu-cxl-type3-mailbox-escape-poc

# Optional: Rebuild the guest image from source

sh build.sh

# Execute the PoC against your QEMU binary

sh run.sh /path/to/qemu-system-x86_64

```

Upon successful exploitation, the console output will display:

```text
stage2 start
pci done
handler=0x00005d41f6d636f0
...
system=0x000077f60c858750
...
stage2 done

```

The presence of `/tmp/qemu_cxl_escape_marker` on the host filesystem confirms the mailbox escape succeeded.

## Summary

- The **QEMU CXL Type-3 Mailbox Escape PoC** is housed in the `qemu-cxl-type3-mailbox-escape-poc/` directory of the bikini/exploitarium repository
- **[`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c)** implements the core vulnerability trigger using the CXL mailbox interface and PCI config space
- **[`build.sh`](https://github.com/bikini/exploitarium/blob/main/build.sh)** and **[`run.sh`](https://github.com/bikini/exploitarium/blob/main/run.sh)** provide fully automated compilation and execution workflows
- The exploit demonstrates a complete guest-to-host escape chain resulting in arbitrary `system()` calls on the host
- Pre-built artifacts (`poc.img`) allow immediate testing, while full source enables custom modification and analysis

## Frequently Asked Questions

### What is the QEMU CXL Type-3 Mailbox Escape PoC?

The QEMU CXL Type-3 Mailbox Escape PoC is a security research artifact that demonstrates a memory-corruption vulnerability in QEMU's implementation of the Compute Express Link (CXL) Type-3 mailbox interface. According to the Exploitarium source code, the proof-of-concept exploits improper validation in mailbox command handling to achieve arbitrary code execution inside the QEMU process from a guest virtual machine.

### How do I build the PoC from source?

Execute the [`build.sh`](https://github.com/bikini/exploitarium/blob/main/build.sh) script in the `qemu-cxl-type3-mailbox-escape-poc/` directory. This script compiles `boot.asm` into 16-bit bootloader code, compiles [`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c) using the freestanding 32-bit target, and links the objects using `stage2.ld` to produce the flat binary `poc.img`.

### What files are included in the qemu-cxl-type3-mailbox-escape-poc directory?

The directory contains [`README.md`](https://github.com/bikini/exploitarium/blob/main/README.md) (documentation), [`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c) (exploit payload), `stage2.ld` (linker script), `boot.asm` (bootloader), [`build.sh`](https://github.com/bikini/exploitarium/blob/main/build.sh) (compilation script), [`run.sh`](https://github.com/bikini/exploitarium/blob/main/run.sh) (QEMU launch wrapper), and `poc.img` (pre-built BIOS floppy image). Each file serves a specific function in the boot chain and exploit execution pipeline.

### How does the exploit demonstrate host escape?

The guest-side code in [`stage2.c`](https://github.com/bikini/exploitarium/blob/main/stage2.c) interacts with the CXL Type-3 mailbox to corrupt QEMU's heap metadata, forge memory objects, and leak host pointers. This corruption chain ultimately redirects execution to the host's `libc system()` function, which executes `touch /tmp/qemu_cxl_escape_marker` on the host filesystem, proving the guest escaped the virtual machine boundary.