CVE-2023-22002

What it actually does

Local high-privileged attacker on the host can read all data accessible to the VirtualBox process, including guest VM contents, due to insufficient isolation in the core component.

Why it matters to the business

Administrators with host access can exfiltrate sensitive information from all running virtual machines, potentially affecting multiple systems and violating data confidentiality requirements.

How an attack unfolds

An attacker with existing administrative login to the host machine executes a crafted sequence against the VirtualBox core to bypass isolation boundaries and retrieve arbitrary guest or host data.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.44 or 7.0.8 or later on all affected hosts.

How to confirm the fix worked

Verify installed VirtualBox version is at or above the fixed releases and confirm no unauthorized local processes are accessing VM memory or disk images.

Typical attack path

1. Obtain high-privileged local account on the host running VirtualBox
2. Trigger the core component flaw via local interaction
3. Access and exfiltrate data belonging to VirtualBox or its guests

How to detect it

Review host authentication logs and process execution history around VirtualBox binaries for unexpected activity by privileged accounts.

What your security team should do

• Apply the fixed versions immediately on all hosts
• Audit host access logs for unusual administrative activity
• Restrict host logins to the minimum necessary personnel