CVE-2022-21491

What it actually does

Local privilege escalation on Windows hosts allowing a low-privileged user to take full control of the VirtualBox process.

Why it matters to the business

Attackers can compromise the virtualization platform, potentially accessing or controlling virtual machines and sensitive data on the host.

How an attack unfolds

A low-privileged attacker logs into the Windows system hosting VirtualBox and executes code that exploits the flaw to escalate privileges and take over the VirtualBox application.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.34 or later on Windows systems.

How to confirm the fix worked

Verify the installed VirtualBox version is 6.1.34 or higher and confirm the vulnerability is no longer present through testing or vendor advisories.

Typical attack path

1. Obtain low-privileged local access to the Windows host
2. Execute malicious code targeting the VirtualBox core component
3. Achieve privilege escalation within the VirtualBox process

How to detect it

Review system logs for unexpected VirtualBox process behavior or privilege changes; check for any post-exploitation artifacts related to the host system.

What your security team should do

• Prioritize updating all Windows installations of VirtualBox to 6.1.34 or newer
• Audit local user access on hosts running VirtualBox
• Monitor for any unusual activity in virtualization processes