CVE-2020-14677: 
VirtualBox vulnerability analysis and mitigation

CVE-2020-14677 is a vulnerability in Oracle VM VirtualBox affecting versions prior to 5.2.44, prior to 6.0.24, and prior to 6.1.12. The vulnerability was disclosed in July 2020 as part of Oracle's Critical Patch Update. It is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability that exists within the handling of Transmit Message Descriptors in the implementation of PCnet virtual network interfaces (ZDI Advisory, Oracle CPU).

The vulnerability is classified as a Time-of-Check Time-of-Use (TOCTOU) race condition, specifically occurring in the PCnet virtual network interface implementation. The issue results from the lack of proper locking when performing operations on an object. It has been assigned a CVSS v3.1 Base Score of 7.5 (High) with the vector string: AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H (NVD, ZDI Advisory).

A successful exploitation of this vulnerability could allow an attacker to escalate privileges and execute code in the context of the hypervisor. The vulnerability requires the attacker to first obtain the ability to execute high-privileged code on the target guest system (ZDI Advisory).

The vulnerability is considered difficult to exploit and requires local access with high privileges. An attacker must first obtain the ability to execute high-privileged code on the target guest system to exploit this vulnerability (ZDI Advisory).

Oracle has released security patches to address this vulnerability in VirtualBox versions 6.1.12, 6.0.24, and 5.2.44. Users are strongly recommended to upgrade to these or later versions. The fix was included in Oracle's July 2020 Critical Patch Update (Oracle CPU, OpenSUSE Advisory).