KB4512941 causes VirtualBox to crash VM with illegal instruction

[CKing123]

After installing KB4512941 (this is repeatable by uninstalling it when VirtualBox (version 6.0.10 and the newest version 6.0.12 I haven't tested any other versions) works but installing it again causes the bug). This is the case with two Windows guests (one being Windows 7 guest (BIOS only) with the other being Windows 10 guest (turned on EFI for special guest OS setting in VirtualBox))

I reported this issue to both Microsoft and I am reporting it here since I don't know whether this is a Virtualbox bug or Windows bug. For now, I rolled back the KB update.

[CKing123]

The error message that I see

[Socratis]

I saw that update, and after doing a little bit of online searching, I decided to avoid it as long as I can, or as long as a newer update was out that superseded this one:

• High CPU usage.
• Broken search.
• Orange (!?) screenshots.

And now this. If it's reversible, I might try and confirm this ticket...

[CKing123]

The VirtualBoxVM log

[CKing123]

I installed the latest September update (KB4515384) and I still have the issue. Since KB4515384 does fix security bugs (0-day) and the high CPU usage during search (but that was a non-issue since I rolled back from the KB4512941 anyways), the security issues mean I will likely not roll back from KB4515384. I looked at the log produced by VirtualBoxVM.exe and attached it here.

[CKing123]

I did some more digging. Since the bug occurred with the directx driver, I reinstalled my host gpu drivers (Intel and Nvidia). This did not make any difference. Then, I decided to set up a new VM, and when I started installing the Guest Additions, the same illegal error came up and the VM was closed. Seems to be an issue with 3d acceleration, so to test it out, I turned off 3d acceleration for a Windows 7 VM and the Vm worked fine (albeit with Aero turned off, but that was expected). When I turned it back on, the same illegal instruction error occurred.

[Socratis]

Yep, you do have a hardening error, "ExitCode=0xc000001d":

4574.6b8: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0xc000001d (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 378232 ms, the end);

Can you try to:

1. Get rid of the following 3rd party antivirus, it's in the list of known adversaries as you can see:

   4574.6b8: supR3HardenedWinFindAdversaries: 0x80
   4574.6b8: \SystemRoot\System32\drivers\MBAMSwissArmy.sys:
   4574.6b8:     CreationTime:    2019-09-11T15:31:40.591432800Z
   4574.6b8:     LastWriteTime:   2019-09-11T15:31:40.591432800Z
   4574.6b8:     ChangeTime:      2019-09-11T15:31:40.604398200Z
   4574.6b8:     FileAttributes:  0x20
   4574.6b8:     Size:            0x43320
   4574.6b8:     NT Headers:      0xf8
   4574.6b8:     Timestamp:       0x5c9e68f9
   4574.6b8:     Machine:         0x8664 - amd64
   4574.6b8:     Timestamp:       0x5c9e68f9
   4574.6b8:     Image Version:   10.0
   4574.6b8:     SizeOfImage:     0x45000 (282624)
   4574.6b8:     Resource Dir:    0x43000 LB 0x3b8
   4574.6b8:     [Version info resource found at 0x48! (ID/Name: 0x1; SubID/SubName: 0x409)]
   4574.6b8:     [Raw version resource data: 0x43060 LB 0x358, codepage 0x0 (reserved 0x0)]
   4574.6b8:     ProductName:     Malwarebytes SwissArmy
   4574.6b8:     ProductVersion:  4.3.0.170
   4574.6b8:     FileVersion:     4.3.0.170
   4574.6b8:     FileDescription: Malwarebytes SwissArmy
   

2. Re-install VirtualBox. I've had several hardening error completely out of the blue, which a re-installation, simply fixed. No indication as to what might have been the culprit...

[CKing123]

I disabled Malwarebytes and ran Virtualbox again on the Windows 7 VM. Once again the illegal instruction occurred. I then followed up with the repair install of VirtualBox by running the installer again. After repair installing and restarting the computer, I ran the Windows 7 VM again, and once again it crashed with illegal instruction. Here is the new log for VirtualBox

[CKing123]

I installed KB4515384 again and now Virtualbox seems to be working fine.