CVE-2022-21627

What it actually does

A local high-privileged attacker can trigger a denial of service condition that causes the VirtualBox process to hang or crash repeatedly through the core component.

Why it matters to the business

Disrupts availability of virtualized workloads on affected hosts, leading to operational downtime and potential service interruptions in environments relying on the virtualization platform.

How an attack unfolds

An attacker with administrative logon access to the host system where VirtualBox executes identifies the vulnerable core component and issues a sequence of local operations that forces the application into a hang or repeated crash state.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.40 or later on all affected installations.

How to confirm the fix worked

Confirm installed Oracle VM VirtualBox versions are 6.1.40 or higher across the environment and review process stability logs for absence of unexplained hangs or crashes.

Typical attack path

1. Obtain high-privileged local logon to the host infrastructure
2. Access the VirtualBox core component on the affected system
3. Trigger the flaw to induce a hang or crash of the VirtualBox process

How to detect it

Review host system logs and VirtualBox process logs for repeated crash or hang events originating from the core component on systems running versions prior to 6.1.40.

What your security team should do

• Apply the 6.1.40 update to all VirtualBox deployments without delay
• Restrict local administrative access to virtualization hosts to the minimum necessary accounts
• Establish monitoring for VirtualBox process crashes as part of routine host health checks