CVE-2022-21554

What it actually does

High-privileged local attacker on the host can trigger a flaw in the VirtualBox core component, resulting in a hang or repeatable crash that denies service to all guests.

Why it matters to the business

Unexpected downtime for virtualized workloads hosted on affected systems, increasing operational costs and potentially interrupting business services until the hypervisor is restarted.

How an attack unfolds

An attacker with administrative access to the virtualization host logs in locally and invokes the vulnerable code path in the core component, causing VirtualBox to crash or hang without requiring network access or user interaction.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.36 or later on all affected hosts; restrict administrative access to virtualization infrastructure where possible.

How to confirm the fix worked

Verify installed VirtualBox version is 6.1.36 or newer; confirm no crashes occur when exercising core functionality under high-privileged local sessions.

Typical attack path

1. Obtain high-privileged local access to the host running Oracle VM VirtualBox
2. Execute or trigger operations that exercise the flawed core component
3. Induce a hang or crash that renders VirtualBox unavailable

How to detect it

Review host system logs and VirtualBox process crash reports for repeated hangs or terminations initiated by local high-privileged sessions; correlate with login events on the infrastructure.

What your security team should do

• Immediately upgrade all Oracle VM VirtualBox installations to 6.1.36 or later
• Audit and minimize the number of accounts with high privileges on virtualization hosts
• Implement host-based monitoring for VirtualBox process stability