CVE-2022-39424

What it actually does

Unauthenticated network attacker can exploit a flaw in the Core component of Oracle VM VirtualBox via VRDP to achieve remote code execution and full takeover of the VirtualBox instance.

Why it matters to the business

Successful exploitation allows complete compromise of virtualized environments, leading to data breaches, service disruption, and potential lateral movement within the infrastructure. The vulnerability has been public for 1460 days with a slight increase in exploit probability (EPSS 0.0144 → 0.0162).

How an attack unfolds

An attacker connects to the VRDP service on a VirtualBox host and sends specially crafted network packets that trigger the vulnerability in the core component, resulting in arbitrary code execution with the privileges of the VirtualBox process.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.40 or later.

How to confirm the fix worked

Verify the installed version is at least 6.1.40 and test VRDP connectivity with updated software.

Typical attack path

1. Identify exposed VRDP ports on VirtualBox hosts
2. Craft and send malicious VRDP packets to trigger the flaw
3. Execute arbitrary code to take over the VirtualBox instance
4. Use compromised host for further attacks or data exfiltration

How to detect it

Look for unusual network traffic to VRDP ports, anomalous process behavior in VirtualBox, or logs indicating failed or successful exploitation attempts.

What your security team should do

• Prioritize patching VirtualBox installations exposed to network
• Monitor for unusual VRDP activity
• Restrict VRDP access to trusted networks