CVE-2019-3026

Vulnerability

The vulnerability resides in the vmsvgaFIFOLoop function of Oracle VM VirtualBox (versions prior to 5.2.34 and 6.0.14). The code fails to validate user-supplied data properly, allowing a read past the end of an allocated object. A low-privileged attacker with logon access to the guest OS can trigger this out-of-bounds read.

Exploitation

The attacker must first obtain low-privileged code execution on the target guest system. Then, by manipulating FIFO data structures, they can cause vmsvgaFIFOLoop to read beyond the intended buffer. The specific flaw is documented in ZDI-19-917 [1], which notes the lack of proper validation leads to an out-of-bounds read.

Impact

Successful exploitation results in unauthorized access to sensitive data — potentially all data accessible to the Oracle VM VirtualBox process. The CVSS 3.0 score is 6.5 (Confidentiality high, Integrity none, Availability none) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N [1]. This means the attacker can read critical hypervisor memory, which may include secrets of other guest VMs or the host.

Mitigation

Oracle released fixes in VirtualBox 5.2.34 and 6.0.14 [1]. Gentoo issued GLSA 202004-02 [2] advising all VirtualBox users to upgrade to these or later versions. No workaround is known; upgrading is the only mitigation.