Cloudanix VulnDB

CVE-2023-22017

Medium · 5.5

CVSS

5.5

EPSS

0.3%

Published

Jul 18, 2023

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A logged-in user on the computer running the virtualization software can make the program freeze or crash, stopping any Windows virtual machines that are in use.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Local low-privileged attacker on the host can trigger a hang or crash in the VirtualBox core when a Windows guest VM is running, resulting in complete denial of service for the hypervisor process.

Why it matters to the business

Unexpected downtime for any workloads running inside affected Windows virtual machines, increasing operational costs and delaying business processes until the hypervisor is restarted.

How an attack unfolds

An attacker with an account on the host machine runs a crafted sequence of operations against the VirtualBox core; because the flaw is local and requires no special privileges beyond logon, the attack immediately causes the hypervisor to hang or terminate, stopping all Windows guests. No remote access or elevated rights are needed.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.46 or 7.0.10 (or later) on all affected hosts. Apply the update through the vendor-supplied installer and verify the new version before restarting VMs.

How to confirm the fix worked

Run the VirtualBox --version command or inspect the installed package metadata on each host and confirm the version is at least 6.1.46 or 7.0.10; re-test a Windows guest VM to ensure normal operation after the upgrade.

Typical attack path

  1. Obtain a low-privileged local account on the host running VirtualBox
  2. Launch or interact with a Windows guest VM
  3. Execute the local trigger that exercises the vulnerable core component
  4. Observe hypervisor hang or repeated crash

How to detect it

Review host system and VirtualBox logs for repeated process terminations or hangs correlated with Windows guest activity; look for entries indicating abrupt VM or hypervisor shutdown without normal guest-initiated events.

What your security team should do

  • Schedule immediate upgrade of all VirtualBox hosts to the fixed releases
  • Temporarily restrict local logons on hosts that cannot be patched quickly
  • Monitor vendor release notes for any follow-on fixes
  • Document the Windows-guest-only scope in internal runbooks

The record

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.46 and Prior to 7.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: This vulnerability applies to Windows VMs only. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS virtualbox 0 No fix
Ubuntu:18.04:LTS virtualbox 0 No fix
Ubuntu:20.04:LTS virtualbox 0 No fix
Ubuntu:22.04:LTS virtualbox 0 No fix
Ubuntu:24.04:LTS virtualbox 0 No fix
Ubuntu:24.10 virtualbox 0 No fix
Ubuntu:25.04 virtualbox 0 No fix
Ubuntu:25.10 virtualbox 0 No fix
Ubuntu:Pro:16.04:LTS virtualbox 0 No fix
Ubuntu:Pro:18.04:LTS virtualbox 0 No fix
Ubuntu:Pro:20.04:LTS virtualbox 0 No fix

Related vulnerabilities