CVE-2022-21487

What it actually does

Local low-privileged process on the host can read a subset of VirtualBox memory or configuration data with scope change allowing impact to additional products.

Why it matters to the business

Potential leakage of sensitive configuration or guest data from virtualized workloads without requiring elevated privileges on the host, increasing compliance and data-breach risk for organizations running multiple VMs.

How an attack unfolds

An attacker with a low-privileged account on the host system where VirtualBox runs crafts or executes code that triggers the Core component flaw, resulting in unauthorized read access to a limited set of VirtualBox-accessible data that may belong to other products due to the scope change.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.34 or later on all affected hosts; apply the update through official Oracle channels and verify the installed version after restart of the VirtualBox service and VMs.

How to confirm the fix worked

Query the VirtualBox installation for the exact version string and confirm it is 6.1.34 or newer; re-test the affected Core component with a low-privileged local account to ensure read access to the previously exposed data subset is denied.

Typical attack path

1. Obtain low-privileged interactive or scheduled-task access on the host running VirtualBox
2. Execute or schedule code that interacts with the vulnerable VirtualBox Core component
3. Trigger the information-disclosure condition to read a subset of protected data
4. Exfiltrate the obtained data for further analysis or lateral movement

How to detect it

Review host authentication and process-creation logs for low-privileged sessions followed by execution of VirtualBox binaries; correlate with any unexpected file or memory reads originating from the VirtualBox process.

What your security team should do

• Prioritize upgrade of all VirtualBox hosts to 6.1.34 within standard change windows given the local attack vector
• Inventory all systems running VirtualBox prior to 6.1.34 and schedule staged rollouts
• Monitor host logs for unusual local processes interacting with VirtualBox executables until patching is complete