CVE-2022-21471

What it actually does

A low-privileged local attacker can trigger a denial-of-service condition inside the VirtualBox core component that results in a complete hang or repeatable crash of the hypervisor process, with scope change allowing the impact to extend to other products running on the same host.

Why it matters to the business

Virtual machines become unavailable, causing operational downtime, loss of productivity for workloads running inside guests, and potential secondary effects on any co-located services that rely on the hypervisor.

How an attack unfolds

An attacker with a valid local account on the host logs in, interacts with the VirtualBox core through normal user interfaces or APIs, and supplies input that triggers the flaw, causing the hypervisor to hang or crash without needing elevated privileges or network access.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.34 or later on all affected hosts. Apply the update through official Oracle channels and restart the hypervisor service after installation.

How to confirm the fix worked

Verify the installed VirtualBox version is 6.1.34 or newer on each host. Confirm the hypervisor starts and runs guest workloads without crashes after the update.

Typical attack path

1. Obtain low-privileged local account on the host running VirtualBox
2. Launch or interact with a VirtualBox instance using standard user permissions
3. Supply crafted input or perform routine operations that reach the vulnerable core code path
4. Trigger the denial-of-service condition resulting in hypervisor hang or crash

How to detect it

Review host system and VirtualBox logs for repeated crashes or hangs of the VBoxSVC or VBoxHeadless processes. Correlate with logon events from low-privileged accounts immediately preceding the crashes.

What your security team should do

• Prioritize patching all VirtualBox installations to 6.1.34 or later within the next maintenance window
• Inventory all hosts running VirtualBox and confirm they are updated before allowing production workloads
• Restrict local logons to VirtualBox hosts to the minimum necessary accounts
• Monitor for hypervisor crashes in system logs as an indicator of potential exploitation attempts