CVE-2024-21111

What it actually does

Local privilege escalation in the Core component of Oracle VM VirtualBox on Windows hosts allows a low-privileged local attacker to fully compromise the VirtualBox process and achieve takeover.

Why it matters to the business

Attackers with initial low-level access to Windows virtualization hosts can seize control of VirtualBox, enabling virtual machine escape, data theft from guests, or disruption of critical virtualized workloads.

How an attack unfolds

An attacker logs on locally to a Windows host running an affected VirtualBox version, leverages the core flaw to escalate privileges within the VirtualBox process, and achieves full takeover; public exploits are available and the vulnerability is limited to Windows hosts.

How to fix it

Upgrade Oracle VM VirtualBox to version 7.0.16 or later on all Windows hosts.

How to confirm the fix worked

Confirm installed VirtualBox version is 7.0.16 or higher via the application about dialog or command-line query; test that low-privileged local users cannot escalate within the VirtualBox process.

Typical attack path

1. Obtain low-privileged local logon on a Windows host running VirtualBox
2. Execute code that triggers the core component vulnerability
3. Escalate privileges to gain full control of the VirtualBox process
4. Perform VM escape or access host resources

How to detect it

Review Windows security and application event logs for anomalous VirtualBox process creations or privilege changes; monitor process execution and file access involving VirtualBox core binaries for unexpected escalation patterns.

What your security team should do

• Immediately upgrade all Windows VirtualBox installations to 7.0.16 or later
• Restrict interactive logons on virtualization hosts to the minimum required personnel
• Enable process monitoring and Windows event logging for VirtualBox binaries