Cloudanix VulnDB

CVE-2022-21465

Medium · 6.7

CVSS

6.7

EPSS

0.4%

Published

Apr 19, 2022

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in VirtualBox allows someone with strong access to the computer it's running on to crash the program or change some of its data.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability allows a high-privileged local attacker to cause a denial of service by crashing or hanging the VirtualBox process and to perform unauthorized modifications to some accessible data, with the impact extending beyond the VirtualBox component due to scope change.

Why it matters to the business

Organizations running VirtualBox may experience unexpected virtual machine downtime and potential integrity issues with configuration or data, leading to operational disruptions.

How an attack unfolds

An attacker with administrative access to the host system where VirtualBox is running exploits a flaw in the core component to trigger a crash or modify data.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.34 or later.

How to confirm the fix worked

Verify the installed version of VirtualBox is 6.1.34 or higher and monitor for any remaining instances of vulnerable versions.

Typical attack path

  1. Obtain high-privileged access on the host system running VirtualBox
  2. Execute or interact with VirtualBox in a manner that triggers the vulnerability
  3. Cause denial of service or data modification

How to detect it

Review system logs for VirtualBox crashes or unexpected terminations, and audit privileged user activities on hosts running VirtualBox.

What your security team should do

  • Prioritize upgrading VirtualBox instances to the latest fixed version
  • Restrict high-privileged access to host systems running VirtualBox
  • Implement monitoring for VirtualBox process crashes

The record

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.7 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H).

Affected packages

Ecosystem Package Introduced Fixed
Mageia:8 kmod-virtualbox 0 6.1.34-1.2.mga8
Mageia:8 virtualbox 0 6.1.34-1.2.mga8
Ubuntu:16.04:LTS virtualbox 0 No fix
Ubuntu:18.04:LTS virtualbox 0 No fix
Ubuntu:20.04:LTS virtualbox 0 No fix
Ubuntu:20.04:LTS vm 0 No fix
Ubuntu:22.04:LTS virtualbox 0 No fix
Ubuntu:22.04:LTS vm 0 No fix
Ubuntu:24.04:LTS virtualbox 0 No fix
Ubuntu:24.04:LTS vm 0 No fix
Ubuntu:24.10 virtualbox 0 No fix
Ubuntu:24.10 vm 0 No fix
Ubuntu:25.04 virtualbox 0 No fix
Ubuntu:25.10 virtualbox 0 No fix
Ubuntu:Pro:16.04:LTS virtualbox 0 No fix
Ubuntu:Pro:16.04:LTS vm 0 No fix
Ubuntu:Pro:18.04:LTS virtualbox 0 No fix
Ubuntu:Pro:18.04:LTS vm 0 No fix
Ubuntu:Pro:20.04:LTS virtualbox 0 No fix
openSUSE:Leap 15.4 virtualbox 0 6.1.36-lp154.2.7.1
openSUSE:Leap 15.4 virtualbox-kmp 0 6.1.36-lp154.2.7.1
openSUSE:Tumbleweed virtualbox 0 6.1.34-1.1

Related vulnerabilities