Cloudanix VulnDB

CVE-2024-21161

Medium · 5.5

CVSS

5.5

EPSS

0.3%

Published

Jul 16, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

On Linux computers, a basic-level user can make the VirtualBox software freeze or crash repeatedly, stopping any virtual machines from running until the software is restarted.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Local low-privileged process on a Linux host can trigger a flaw in the VirtualBox core that causes the entire VirtualBox process to hang or enter a repeatable crash loop, resulting in denial of service for all guest VMs.

Why it matters to the business

Unexpected downtime for virtualized workloads running on Linux hosts, interrupting business services and requiring manual intervention to restart the hypervisor.

How an attack unfolds

An attacker with a low-privileged account on a Linux host running an affected VirtualBox version executes local code or commands that reach the vulnerable core component, forcing the VirtualBox process into a hang or crash state without needing elevated privileges or network access.

How to fix it

Upgrade Oracle VM VirtualBox to version 7.0.20 or later on all Linux hosts; until the update can be applied, restrict interactive logons to the minimal set of trusted users and monitor for abnormal VirtualBox process terminations.

How to confirm the fix worked

Confirm installed package version is 7.0.20 or newer; attempt to reproduce the crash condition from a low-privileged account and verify the process remains stable.

Typical attack path

  1. Obtain low-privileged interactive or scheduled-task access on the Linux host
  2. Invoke or interact with the VirtualBox process in a manner that exercises the flawed core code path
  3. Trigger repeated process termination or hang, denying service to all running VMs

How to detect it

Review system and application logs on Linux hosts for repeated VirtualBox process crashes or segmentation faults originating from low-privileged sessions; correlate with authentication logs showing non-administrative logons immediately preceding the events.

What your security team should do

  • Apply the 7.0.20 update to all Linux hosts running VirtualBox within the next maintenance window
  • Limit interactive and scheduled-task access on virtualization hosts to trusted administrative accounts
  • Configure process monitoring and alerting for unexpected VirtualBox terminations

The record

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: This vulnerability applies to Linux hosts only. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Affected packages

Ecosystem Package Introduced Fixed
Mageia:9 kmod-virtualbox 0 7.0.20-51.mga9
Mageia:9 virtualbox 0 7.0.20-1.mga9
Ubuntu:16.04:LTS virtualbox 0 No fix
Ubuntu:18.04:LTS virtualbox 0 No fix
Ubuntu:20.04:LTS virtualbox 0 No fix
Ubuntu:22.04:LTS virtualbox 0 No fix
Ubuntu:24.04:LTS virtualbox 0 No fix
Ubuntu:24.10 virtualbox 0 No fix
Ubuntu:25.04 virtualbox 0 No fix
Ubuntu:25.10 virtualbox 0 No fix
Ubuntu:Pro:16.04:LTS virtualbox 0 No fix
Ubuntu:Pro:18.04:LTS virtualbox 0 No fix
Ubuntu:Pro:20.04:LTS virtualbox 0 No fix

Related vulnerabilities