Cloudanix VulnDB

CVE-2022-39422

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Oct 18, 2022

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A trusted administrator on the same computer as the virtualization software can, with significant effort, take over that software and potentially reach other systems it manages.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
High
Impact
Full Compromise
Component
Application
Class
Privilege Escalation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Local high-privileged attacker on the host can exploit a difficult race or logic condition in the VirtualBox Core component to achieve full takeover of the VirtualBox process, with scope change allowing impact on other products on the same host.

Why it matters to the business

Successful exploitation can result in complete control of virtualized workloads, exposing sensitive data, disrupting operations, and enabling lateral movement; the issue affects organizations running older VirtualBox releases on multi-tenant or critical infrastructure hosts.

How an attack unfolds

An attacker who already possesses high-privileged local access on a system hosting VirtualBox crafts specific inputs or timing sequences against the Core component; because the flaw is difficult to exploit, the attacker must combine host-level privileges with precise conditions to break out of intended isolation and seize control of the VirtualBox process and any guest VMs.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.38 or later on all affected hosts; apply the update through official Oracle channels and verify the running version after installation.

How to confirm the fix worked

Run the VirtualBox command-line tool with the --version flag on each host and confirm the reported version is 6.1.38 or newer; re-execute any internal hardening or configuration checks that cover virtualization components.

Typical attack path

  1. Obtain high-privileged local logon on the VirtualBox host
  2. Prepare and trigger the Core-component flaw using local attack primitives
  3. Escalate to full control of the VirtualBox process
  4. Leverage scope change to impact additional products or guest workloads

How to detect it

Review host authentication logs for unusual high-privileged logons around the time of any VirtualBox process anomalies; examine system and application logs for unexpected VirtualBox crashes, privilege changes, or child-process spawns that deviate from normal operation.

What your security team should do

  • Prioritize patching all VirtualBox installations to 6.1.38+ within the next maintenance window
  • Review and reduce the number of accounts with high privileges on virtualization hosts
  • Monitor vendor announcements for any follow-on updates or additional CVEs in the same component

The record

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.38. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:18.04:LTS virtualbox 0 No fix
Ubuntu:20.04:LTS virtualbox 0 6.1.38-dfsg-3~ubuntu1.20.04.1
Ubuntu:Pro:18.04:LTS virtualbox 0 No fix

Related vulnerabilities