Cloudanix VulnDB

CVE-2023-21898

Medium · 5.5

CVSS

5.5

EPSS

0.3%

Published

Jan 18, 2023

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in VirtualBox lets someone who can already log into the computer crash or freeze virtual machines, interrupting whatever work those machines support.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Low-privileged local attacker on the host can trigger a flaw in the VirtualBox core component to cause the VirtualBox process to hang or repeatedly crash, resulting in complete denial of service for affected virtual machines running Windows 7 and later.

Why it matters to the business

Virtual machine workloads experience unplanned downtime and repeated crashes, disrupting business operations that depend on virtualization for testing, development, or production services; patching urgency is moderate given stable low EPSS and lack of known exploitation.

How an attack unfolds

An attacker with local logon access to the host machine where VirtualBox runs interacts with the application in a way that exercises the vulnerable code path in the core component, forcing an unhandled condition that terminates or freezes the VirtualBox process and any running VMs.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.42 or 7.0.6 or later on all affected hosts; apply updates through official Oracle channels and verify the installed version after deployment.

How to confirm the fix worked

Query the installed VirtualBox version via the application UI, command-line tools such as VBoxManage --version, or host package managers and confirm it meets or exceeds 6.1.42 or 7.0.6; retest VM startup and stability under load.

Typical attack path

  1. Obtain low-privileged local account on the host system running VirtualBox
  2. Launch or interact with VirtualBox and a Windows 7+ guest VM to reach the vulnerable code path
  3. Trigger the flaw to induce hang or crash of the VirtualBox process

How to detect it

Review host system and application logs for repeated VirtualBox process crashes or hangs around the time of reported VM instability; correlate with low-privileged user sessions on the host.

What your security team should do

  • Prioritize patching VirtualBox installations on hosts that run Windows 7+ guests within the next maintenance window
  • Inventory all VirtualBox deployments and confirm fixed versions are applied across the environment
  • Monitor vendor release notes for any follow-on updates addressing related issues

The record

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: Applies to VirtualBox VMs running Windows 7 and later. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS virtualbox 0 No fix
Ubuntu:18.04:LTS virtualbox 0 No fix
Ubuntu:20.04:LTS virtualbox 0 No fix
Ubuntu:22.04:LTS virtualbox 0 No fix
Ubuntu:24.04:LTS virtualbox 0 No fix
Ubuntu:24.10 virtualbox 0 No fix
Ubuntu:25.04 virtualbox 0 No fix
Ubuntu:25.10 virtualbox 0 No fix
Ubuntu:Pro:16.04:LTS virtualbox 0 No fix
Ubuntu:Pro:18.04:LTS virtualbox 0 No fix
Ubuntu:Pro:20.04:LTS virtualbox 0 No fix
openSUSE:Leap 15.4 virtualbox 0 7.0.6-lp154.2.26.2
openSUSE:Leap 15.4 virtualbox-kmp 0 7.0.6-lp154.2.26.2
openSUSE:Tumbleweed virtualbox 0 7.0.6-1.1

Related vulnerabilities