CVE-2023-22018

What it actually does

The flaw permits unauthenticated remote code execution inside the VirtualBox core component when an attacker reaches the host over RDP; successful exploitation grants full control of the VirtualBox process and all guest virtual machines running on it.

Why it matters to the business

Attackers who reach the virtualization host can seize every virtual machine, exposing or destroying workloads that may contain sensitive data; the vulnerability has been public for over three years with stable low exploit probability, yet any exposed RDP service remains a persistent operational risk.

How an attack unfolds

An attacker with network access to the VirtualBox host initiates an RDP connection and crafts a sequence of network packets that trigger the flaw in the core component; because the bug is difficult to exploit, the attacker must supply a precise, low-noise payload that ultimately executes arbitrary code inside the VirtualBox process, achieving takeover of the virtualization platform.

How to fix it

Upgrade Oracle VM VirtualBox to version 6.1.46 or 7.0.10 (or later) on every host; if immediate patching is not possible, restrict RDP access to trusted networks only and monitor for anomalous RDP traffic.

How to confirm the fix worked

Query the installed VirtualBox version on each host and confirm it is at least 6.1.46 or 7.0.10; re-scan exposed RDP ports to verify they are no longer reachable from untrusted networks.

Typical attack path

1. Locate VirtualBox hosts that accept RDP connections from untrusted networks
2. Establish an RDP session to the host
3. Send a crafted RDP payload targeting the core component
4. Trigger the memory corruption or logic error to achieve code execution
5. Escalate to full control of VirtualBox and all guest VMs

How to detect it

Search RDP connection logs, VirtualBox process creation events, and network flow records for unexpected inbound RDP sessions to hosts running older VirtualBox versions; look for sudden spikes in CPU or memory usage of the VirtualBox process that coincide with RDP activity.

What your security team should do

• Prioritize patching all VirtualBox hosts to 6.1.46 or 7.0.10 within the next change window
• Disable or strictly firewall RDP access to virtualization hosts from untrusted networks
• Add VirtualBox version checks to asset inventory and vulnerability scanning processes
• Review logs for any historical RDP connections to VirtualBox hosts since publication