CVE-2019-3005

Vulnerability

This vulnerability exists in the Core component of Oracle VM VirtualBox, affecting versions prior to 5.2.34 and prior to 6.0.14 [1]. The bug lies within an unspecified core function that can be triggered by a high-privileged attacker who has logged on to the operating system where VirtualBox is installed.

Exploitation

An attacker must have high privileges (e.g., root or Administrator) on the host system and must be able to log on locally to the environment where VirtualBox runs. No user interaction or complex timing is required [1]. The attacker can then exploit the vulnerability through the VirtualBox core component, likely by invoking a specific operation that triggers the flaw.

Impact

Successful exploitation results in a denial of service (DoS) causing a hang or frequently repeatable crash of VirtualBox, making it unavailable [1]. The impact extends beyond VirtualBox itself, potentially affecting other products or services relying on the vulnerable host, as indicated by the CVSS scope change (S:C) [description].

Mitigation

Oracle released fixed versions: VirtualBox 5.2.34 and 6.0.14 [description]. Gentoo advisories recommend upgrading to the latest available versions for each branch (e.g., 5.2.36, 6.0.16, 6.1.2 or later) [1][2]. No workaround is known [1]. Users should apply the update as soon as possible.