CVE-2024-21113

What it actually does

Local privilege escalation in VirtualBox core that permits a low-privileged local account to obtain full control of the VirtualBox process and hypervisor with scope change to other products on the host.

Why it matters to the business

Compromise of the virtualization layer can allow an attacker to escape the guest, control multiple virtual machines, and impact production workloads hosted on the same physical system.

How an attack unfolds

An attacker with a low-privileged local session on the host logs in and triggers the flaw in the core component to escalate privileges and seize control of the VirtualBox instance, potentially affecting other software due to the scope change.

How to fix it

Upgrade Oracle VM VirtualBox to version 7.0.16 or later on all affected hosts.

How to confirm the fix worked

Verify installed VirtualBox version is 7.0.16 or newer; review host logs for unexpected VirtualBox process behavior or privilege changes.

Typical attack path

1. Obtain low-privileged local access to a host running affected VirtualBox
2. Execute crafted input against the core component
3. Escalate to full VirtualBox process takeover
4. Leverage control to impact additional products on the host

How to detect it

Review host authentication logs for unexpected low-privileged sessions followed by VirtualBox process anomalies; examine system logs for privilege-escalation indicators around VirtualBox execution.

What your security team should do

• Immediately upgrade all VirtualBox installations to 7.0.16 or later
• Restrict local logon rights on virtualization hosts to the minimum necessary accounts
• Monitor for post-upgrade anomalies in VirtualBox processes