CVE-2022-21621

What it actually does

Allows a high-privileged local attacker to trigger a complete denial of service (hang or repeatable crash) against the VirtualBox process, with scope change that can affect additional products on the host.

Why it matters to the business

Disrupts virtualized workloads and any dependent services, causing unplanned downtime and operational impact across multiple systems until the hypervisor is restarted.

How an attack unfolds

An attacker with administrative logon to the host where VirtualBox runs exploits the core component to force the process into a hung or crashed state, resulting in loss of availability for all running virtual machines and potential side effects on other host components.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.40 or later on all affected hosts.

How to confirm the fix worked

Confirm the installed VirtualBox version is 6.1.40 or newer via the product interface or command-line query; retest that the denial-of-service condition no longer occurs under the documented attack scenario.

Typical attack path

1. Obtain high-privileged local access to the host infrastructure running VirtualBox
2. Trigger the vulnerable code path in the Core component
3. Cause repeated hang or crash of the VirtualBox process

How to detect it

Review host system logs and VirtualBox process crash dumps for repeated unexpected terminations or hangs; correlate with privileged login events on the same hosts.

What your security team should do

• Apply the fixed version 6.1.40 immediately on all hosts
• Limit administrative logons to VirtualBox hosts to the minimum necessary accounts
• Monitor for availability alerts on VirtualBox processes