Meta Quest 2: Defense through offense

This post details the discovery of a memory corruption vulnerability in the Meta Quest 2's VR Runtime service, which allowed for arbitrary native code execution from an unprivileged application. The post outlines the VROS architecture, the VR Runtime service's role and attack surface, the Runtime IPC communication mechanism, and the specific vulnerability that enabled an 8-byte write primitive. It further explains how this primitive was used to hijack control flow by overwriting a Vulkan interface function pointer (vkGetPhysicalDeviceImageFormatProperties) to achieve arbitrary native code execution, providing actionable insights for improving Meta Quest product security.