CVE-2020-14698: 
VirtualBox vulnerability analysis and mitigation

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core) affecting versions prior to 5.2.44, prior to 6.0.24, and prior to 6.1.12. The vulnerability was discovered by Ziming Zhang from Codesafe Team of Legendsec at Qi'anxin Group and was disclosed in July 2020 (Oracle Advisory).

This is a difficult to exploit vulnerability that allows high privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability has been assigned a CVSS 3.1 Base Score of 5.3 (Confidentiality impacts) with the vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N (NVD).

While the vulnerability exists in Oracle VM VirtualBox, successful attacks may significantly impact additional products. Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data (Oracle Advisory, ZDI Advisory).

The vulnerability requires a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes. The attack complexity is considered high, requiring specific conditions for exploitation (NVD).

Oracle has released security patches to address this vulnerability in VirtualBox versions 5.2.44, 6.0.24, and 6.1.12. Users are strongly advised to upgrade to these or later versions (OpenSUSE Advisory, Gentoo Advisory).