CVE-2020-14674: 
VirtualBox vulnerability analysis and mitigation

A vulnerability was discovered in Oracle VM VirtualBox affecting versions prior to 5.2.44, prior to 6.0.24, and prior to 6.1.12. The vulnerability (CVE-2020-14674) exists within the lsilogicR3DiagRegDataWrite function and is related to a Time-Of-Check Time-Of-Use (TOCTOU) race condition. This vulnerability was disclosed on July 14, 2020, as part of Oracle's Critical Patch Update (Oracle CPU, ZDI Advisory).

The vulnerability is classified as a Time-Of-Check Time-Of-Use (TOCTOU) race condition in the lsilogicR3DiagRegDataWrite function. It has been assigned a CVSS v3.1 Base Score of 7.5 (High) with the vector string: AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. The issue results from the lack of proper locking when performing operations on an object (ZDI Advisory).

A successful exploitation of this vulnerability can result in takeover of Oracle VM VirtualBox, potentially leading to execution of code in the context of the hypervisor. The vulnerability affects the confidentiality, integrity, and availability of the system (Oracle CPU, ZDI Advisory).

The vulnerability is considered difficult to exploit and requires a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes. An attacker must first obtain the ability to execute high-privileged code on the target guest system to exploit this vulnerability (ZDI Advisory).

Oracle has released patches to address this vulnerability in VirtualBox versions 5.2.44, 6.0.24, and 6.1.12. Users are strongly recommended to upgrade to these or later versions. The fix was included in Oracle's July 2020 Critical Patch Update (Oracle CPU, OpenSUSE Update).