Cloudanix VulnDB

CVE-2022-39421

High · 7.3

CVSS

7.3

EPSS

0.4%

Published

Oct 18, 2022

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

An old flaw in VirtualBox on Windows can let someone with basic computer access trick another user into handing over complete control of the program.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Privilege Escalation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Local privilege escalation flaw in Oracle VM VirtualBox Core on Windows allowing a low-privileged authenticated user to achieve full application takeover after social-engineering interaction from a second user on the host.

Why it matters to the business

Unpatched Windows hosts running older VirtualBox versions remain exposed to full virtual-machine control by attackers, risking data theft, VM manipulation, and operational disruption years after disclosure.

How an attack unfolds

A low-privileged attacker on a Windows host running VirtualBox prepares a malicious artifact, then relies on another user to interact with it (open, click, or load); the interaction triggers the flaw, escalating privileges and granting complete control over the VirtualBox process and any running VMs.

How to fix it

Upgrade every Oracle VM VirtualBox installation on Windows to version 6.1.40 or later; remove or isolate any remaining older instances.

How to confirm the fix worked

Query the installed VirtualBox version on all Windows hosts and confirm it is 6.1.40 or higher; re-scan after deployment to verify absence of vulnerable binaries.

Typical attack path

  1. Gain low-privileged local access on a Windows host executing Oracle VM VirtualBox
  2. Craft a malicious file or input designed to trigger the core flaw
  3. Induce a second user to perform the required interaction
  4. Escalate privileges to achieve full VirtualBox takeover

How to detect it

Review Windows event logs and VirtualBox process-creation events for unexpected privilege changes or anomalous child processes following user file interactions on affected hosts.

What your security team should do

  • Immediately upgrade all Oracle VM VirtualBox instances to 6.1.40 or newer
  • Limit local logons and file-interaction privileges on hosts running VirtualBox
  • Harden Windows hosts to reduce the impact of local privilege-escalation attempts

The record

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows systems only. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS virtualbox 0 No fix
Ubuntu:18.04:LTS virtualbox 0 No fix
Ubuntu:20.04:LTS virtualbox 0 No fix
Ubuntu:22.04:LTS virtualbox 0 No fix
Ubuntu:Pro:16.04:LTS virtualbox 0 No fix
Ubuntu:Pro:18.04:LTS virtualbox 0 No fix
Ubuntu:Pro:20.04:LTS virtualbox 0 No fix

Related vulnerabilities