CVE-2021-2111

Vulnerability

An easily exploitable vulnerability exists in the Core component of Oracle VM VirtualBox versions prior to 6.1.18 [1]. This vulnerability requires a high privileged attacker with logon to the infrastructure where VirtualBox executes. The specific code path is triggered by an attacker with elevated privileges within the host environment, affecting the stability of the virtualization software.

Exploitation

To exploit this vulnerability, an attacker must have a high level of privilege (administrator or root equivalent) on the host system where VirtualBox is installed. The attacker must also have logon access to that host. No user interaction is required. The attacker then leverages this position to perform actions that lead to the hang or crash of the VirtualBox process via the vulnerable component.

Impact

Successful exploitation results in a denial-of-service (DoS) condition, manifesting as a system hang or frequent, repeatable crash of Oracle VM VirtualBox. This causes a complete loss of availability for the virtualization service, impacting not only the host VM manager but potentially other products that depend on it, as indicated by the CVSS scope change (S:C). There is no impact to confidentiality or integrity.

Mitigation

The vulnerability is fixed in Oracle VM VirtualBox version 6.1.18 and later [1]. The Gentoo security advisory recommends upgrading all VirtualBox users to version 6.1.18 or higher [1]. There is no known workaround for this issue [1]. Users should apply the latest updates from their vendor.