Why is VBoxVGA without 3D support unrecommended?

[Miro_R]

Hello, are there any performance/security disadvantages when using VBoxVGA without 3D support on a Linux guest (Ubuntu and its derivates)?

I know that VBoxVGA in combination with 3D support is from 6.1 considered deprecated, but I currently noticed that while using a Linux OS (Ubuntu derivate) my VM manager states that using of "VBoxVGA is not recommended". I dont need a 3D support, performance of VGA is ok and I like its ability to automaticaly adjust the resolution of the Guest. And I usually do not change things which work just because I can

Considering I don't need a 3D, is there a reason to move to VMSVGA or it does not matter a I can stick to old VBoxVGA without any (mostly security) concerns? Thank you in advance!

[mpack]

It isn't possible for any of us to answer that definitively - we don't know what the devs have in store for us. However VBoxVGA has been deprecated, so it could potentially be removed in a future VBox version. Yes, you can cross that bridge when you come to it, but meantime I certainly wouldn't create any new Linux VMs using VBoxVGA, I mean why would you?

And incidentally, 3D acceleration isn't just for 3D. It allows for faster (lower CPU overhead) graphics in general, which is important to cater for the trend to UHD+ high res (4K) displays.

[Miro_R]

Thank you for your reply mpack. So it is deprecated in general? I thought that using "VBoxVGA with 3D support" is deprecated (e.g. oracle.com) but I did not find anything about VBoxVGA itself.

In my case is 3D support really expendable. The VM I am talking about is used as an independent malware scanner for less trustworthy e-mails and stuff, so I am concerned more about its security than performance. My motivation to use an old VGA is maybe wrong - I somehow historically thought that VBoxVGA is more stable and secure and VMSVGA is bether performing but also more risky, but according to superuser.com it's probably wrong.

Documentation does not state anything more particular, so I came here to find out the truth and maybe I am in good faith using a worse setting for a few years now

[scottgus1]

The deprecation around 3D and VboxVGA regards how 3D acceleration was done with VboxVGA, namely a simple pass-through of VM video instructions to the host video for calculation, which is a security hole big enough to drive a convoy of Australian road trains through. If VboxVGA is not using 3D acceleration, then the security is not compromised.

In 6.0 Oracle added VboxSVGA and VMSVGA, both with 3D acceleration, while leaving 3D acceleration inplace for VboxVGA. In 6.1 Oracle removed 3D acceleration support from VboxVGA. However, for backwards compatibility for VMs that were set up with VboxVGA the card itself has been kept.

It is probably likely (as my non-dev guess) that the VboxVGA card sans 3D will be kept for the period while Virtualbox continues to support VM OS's that used VboxVGA back in the day (like Windows 2000, XP, Vista and similar Linux).

[Miro_R]

So I understand it in a way that VBoxVGA is not deprecated (end of support or end of life), but just "old" and thus not recommended in comparision with VMSVGA because of its performance, lack of security when using 3D and aim to (mostly) older OS'es. Right?

which is a security hole big enough to drive a convoy of Australian road trains through

I love your analogy btw new severity classification

[scottgus1]

VboxVGA is still around and usable. We on the forum cannot say how long it will remain around and usable. Since some folks still have 2000 and XP VMs that were installed with VboxVGA and still hope to use those VMs, and 2000 & XP are still supported VM OSs, it is reasonable to guess that VboxVGA will be around for the foreseeable future. But we cannot say definitely. It would be a good idea to try to use VboxSVGA or VMSVGA if only for the possibility that VboxVGA might be removed in the unforeseeable future.

VboxSVGA is recommended for Windows VMs, and VMSVGA is recommended for Linux VMs. VMSVGA is apparently provided as a compatibility provision for im/exported VMs to other hypervisors, if I remember correctly, so the VM OS won't have to endure a video card change. You're free to try anything you want, and some Linux VM users have anecdotally reported glitches with VMSVGA that go away with VboxSVGA.

[Miro_R]

Thank you for a very comprehensive answer.

One more thing regarding security. This post on superuser mentions better security with VMSVGA (which is certainly the case with 3D). Is there any difference with 3D support turned off?