Cloudanix VulnDB

CVE-2023-21990

High · 8.2

CVSS

8.2

EPSS

0.3%

Published

Apr 18, 2023

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A person who already has strong access to the computer running the virtualization software can take over that software and everything it manages.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Privilege Escalation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Local high-privileged attacker can exploit a flaw in the VirtualBox core component to achieve full takeover of the VirtualBox process with scope change that affects additional products on the host.

Why it matters to the business

An attacker already present on the virtualization host with administrative access can seize control of running virtual machines and the hypervisor itself, leading to loss of confidentiality, integrity, and availability across multiple workloads.

How an attack unfolds

A high-privileged user logs into the host system where VirtualBox executes, triggers the vulnerable code path in the core component, and leverages the resulting privileges to take over the VirtualBox instance and any affected guest or host resources.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.44 or 7.0.8 or later on all affected hosts. Apply the updates through official Oracle channels and verify the installed version after deployment.

How to confirm the fix worked

Confirm the running VirtualBox version reports 6.1.44 or 7.0.8 or newer, then attempt to reproduce the local attack vector with a high-privileged account to verify the issue is no longer present.

Typical attack path

  1. Obtain high-privileged logon to the infrastructure hosting VirtualBox
  2. Interact with the affected core component to trigger the flaw
  3. Escalate to full control of the VirtualBox process
  4. Leverage scope change to impact additional products and resources

How to detect it

Review host authentication logs for unexpected high-privileged sessions around VirtualBox processes, inspect process creation events for VirtualBox binaries, and look for unusual interactions between the hypervisor and guest VMs.

What your security team should do

  • Prioritize patching all VirtualBox installations to the fixed releases within the next maintenance window
  • Review host access controls to ensure only necessary personnel hold high-privileged accounts
  • Monitor for any post-patch anomalies in VirtualBox process behavior or guest interactions

The record

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Affected packages

Ecosystem Package Introduced Fixed
Mageia:8 kmod-virtualbox 0 7.0.8-1.mga8
Mageia:8 virtualbox 0 7.0.8-1.mga8
Ubuntu:16.04:LTS virtualbox 0 No fix
Ubuntu:18.04:LTS virtualbox 0 No fix
Ubuntu:20.04:LTS virtualbox 0 No fix
Ubuntu:22.04:LTS virtualbox 0 No fix
Ubuntu:24.04:LTS virtualbox 0 No fix
Ubuntu:24.10 virtualbox 0 7.0.16-dfsg-2
Ubuntu:Pro:16.04:LTS virtualbox 0 No fix
Ubuntu:Pro:18.04:LTS virtualbox 0 No fix
Ubuntu:Pro:20.04:LTS virtualbox 0 No fix
openSUSE:Leap 15.4 virtualbox 0 7.0.8-lp154.2.32.2
openSUSE:Leap 15.4 virtualbox-kmp 0 7.0.8-lp154.2.32.1
openSUSE:Tumbleweed virtualbox 0 7.0.8-1.1

Related vulnerabilities