CVE-2020-14885

Vulnerability

In Oracle VM VirtualBox prior to 6.1.16, the shader_generate_main function in the Core component lacks proper validation of user-supplied data, resulting in an out-of-bounds read [1]. The vulnerability requires an attacker to have high privileges on the guest operating system.

Exploitation

An attacker must first obtain the ability to execute high-privileged code on the target guest system. By supplying crafted shader bytecode, the attacker can trigger the out-of-bounds read and potentially leverage this in conjunction with other vulnerabilities to execute code in the context of the hypervisor [1].

Impact

Successful exploitation leads to unauthorized access to critical data or complete disclosure of all Oracle VM VirtualBox accessible data, with high confidentiality impact. Due to the scope change, attacks may significantly impact additional products [1].

Mitigation

Oracle released version 6.1.16 which includes a fix for this vulnerability. Gentoo recommends upgrading to version 6.1.18 or later [2]. No known workarounds exist [2].