CVE-2020-2703

Vulnerability

This vulnerability resides in the Core component of Oracle VM VirtualBox, affecting versions prior to 5.2.36 and prior to 6.0.16 [1]. The bug allows a low-privileged attacker with local logon access to the host system to trigger a hang or frequently repeatable crash, leading to a complete denial of service of the VirtualBox application [1].

Exploitation

An attacker needs local logon access to the host where VirtualBox runs and a low-privileged account. The exploit is simple to perform (low complexity) and requires no user interaction beyond the attacker's own actions [1]. The exact sequence of steps is not detailed in the references, but the attack vector is local and leverages the Core component.

Impact

Successful exploitation results in an unauthorized ability to cause a hang or frequently repeatable crash of VirtualBox, resulting in a complete denial of service (availability impact). The CVSS 3.0 base score is 6.5 (Availability: High) with scope change, meaning the attack can also affect other products beyond VirtualBox itself [1]. No confidentiality or integrity impact is reported.

Mitigation

Oracle released fixed versions 5.2.36 and 6.0.16 in January 2020 [1]. Users should upgrade to these or later versions. The Gentoo security advisory also recommends upgrading to at least these versions or later releases (e.g., 6.1.2) [2]. No workaround was available at the time of disclosure [1].