CVE-2020-14694: 
VirtualBox vulnerability analysis and mitigation

A vulnerability was discovered in Oracle VM VirtualBox's Core component affecting versions prior to 5.2.44, prior to 6.0.24, and prior to 6.1.12. The vulnerability (CVE-2020-14694) was disclosed on July 15, 2020, and involves an out-of-bounds read information disclosure issue in the BusLogicSCSI component (ZDI Advisory, Oracle Advisory).

The vulnerability exists within the processing of buslogic commands and results from the lack of proper validation of user-supplied data, which can lead to a read past the end of an allocated data structure. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N), indicating it requires local access and high privileges to exploit (ZDI Advisory).

A successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (Oracle Advisory).

The vulnerability is considered difficult to exploit and requires a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes. An attacker must first obtain the ability to execute high-privileged code on the target guest system to exploit this vulnerability (ZDI Advisory).

Oracle has released security patches to address this vulnerability in VirtualBox versions 5.2.44, 6.0.24, and 6.1.12. Users are strongly recommended to upgrade to these patched versions. The fix was included in Oracle's July 2020 Critical Patch Update (Oracle Advisory).