CVE-2022-21394

What it actually does

Allows a low-privileged local attacker with access to the host running VirtualBox to read sensitive data from the hypervisor or guest environments due to insufficient isolation in the Core component.

Why it matters to the business

Organizations running affected versions face risk of unauthorized exposure of virtual machine data or configuration details, potentially leading to compliance violations or loss of intellectual property; low EPSS and lack of KEV status indicate limited observed exploitation but the local attack vector still requires prompt attention for environments with many dependents.

How an attack unfolds

An attacker with existing logon rights on the virtualization host leverages the flaw in the Core component to bypass isolation boundaries and extract critical data accessible to VirtualBox, with possible impact on other products due to the changed scope.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.32 or later; apply the exact fixed commit 0d073ee461edd5f42528d41e00bf0a7b22e86bb3 where package-specific patches are referenced.

How to confirm the fix worked

Verify the installed VirtualBox version is 6.1.32 or higher; review release notes for Core component fixes and test that low-privileged users cannot access protected data structures.

Typical attack path

1. Obtain low-privileged logon to the host system running VirtualBox
2. Execute code or commands that trigger the information disclosure in the Core component
3. Read or exfiltrate sensitive data from VirtualBox memory, configurations, or guest interactions

How to detect it

Review host system logs for unusual VirtualBox process behavior or data access patterns by low-privileged accounts; examine audit trails for unexpected reads of VM configuration or memory artifacts post-authentication.

What your security team should do

• Prioritize upgrade of all VirtualBox installations to 6.1.32 within standard change windows given the 1733 days since publication
• Audit host access controls to ensure only necessary users have logon rights to virtualization infrastructure
• Monitor EPSS trend stability and re-evaluate if new exploit maturity emerges