CVE-2022-21571

What it actually does

Local privilege escalation in the VirtualBox core that allows a high-privileged process on the host to escape its sandbox and seize control of the entire VirtualBox instance, including guest VMs.

Why it matters to the business

An attacker already on the virtualization host can fully compromise all virtual machines and any data or services they contain, leading to widespread data exposure or service disruption across the environment.

How an attack unfolds

An attacker with administrative access on the host logs into the system, triggers the flaw in the VirtualBox core through normal hypervisor operations, and uses the resulting escalation to take over the VirtualBox process and all running guests.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.36 or later on all affected hosts. Until the update can be applied, restrict administrative access to the host to the minimum necessary personnel and monitor for anomalous VirtualBox process behavior.

How to confirm the fix worked

Verify that every host runs VirtualBox 6.1.36 or newer, confirm the installed package version matches the vendor advisory, and re-test that high-privileged local accounts cannot access guest memory or disk images outside their assigned VMs.

Typical attack path

1. Obtain high-privileged shell on the virtualization host
2. Interact with VirtualBox core components to trigger the flaw
3. Escalate privileges within the VirtualBox process
4. Gain control over guest VMs and their resources

How to detect it

Review host system logs and VirtualBox process audit trails for unexpected privilege changes or attempts to access guest resources from outside the normal hypervisor context.

What your security team should do

• Immediately schedule upgrade of all VirtualBox installations to 6.1.36+
• Limit host administrative accounts and enforce least-privilege access
• Add host-based monitoring for unexpected VirtualBox process interactions
• Review virtualization isolation controls and guest data protection policies