CVE-2022-21295

What it actually does

Low-privileged local attacker on Windows can read a subset of VirtualBox accessible data due to a flaw in the Core component.

Why it matters to the business

Limited data exposure risk on Windows hosts running affected VirtualBox versions; low urgency given low EPSS and no KEV or ransomware usage, though downstream GitLab dependents may warrant separate review of the listed commit fix.

How an attack unfolds

An attacker with existing logon access to the Windows host where VirtualBox runs exploits the core component to read unauthorized data; no named threat actors or campaigns are associated.

How to fix it

Upgrade Oracle VM VirtualBox to 6.1.32 or later; for gitlab-org/gitlab apply the fix in commit 661f7e4160fd380b54f36039b0e7f585b4cdb647.

How to confirm the fix worked

Confirm VirtualBox version is 6.1.32 or newer on Windows systems and review GitLab instances for the listed commit if applicable.

Typical attack path

1. Obtain low-privileged logon to the Windows host running VirtualBox
2. Trigger the core component flaw
3. Read subset of accessible data

How to detect it

Review host logs for unusual VirtualBox process behavior or data access patterns post-authentication; check for presence of the vulnerable version.

What your security team should do

• Prioritize patching Windows VirtualBox hosts to 6.1.32+
• Verify no GitLab instances require the referenced commit update
• Monitor for any future EPSS increase