CVE-2020-14704: 
VirtualBox vulnerability analysis and mitigation

CVE-2020-14704 affects Oracle VM VirtualBox versions prior to 5.2.44, prior to 6.0.24, and prior to 6.1.12. The vulnerability was disclosed in July 2020 as part of Oracle's Critical Patch Update. This vulnerability exists within the BusLogicSCSI component of VirtualBox and allows high-privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system (Oracle CPU, ZDI Advisory).

The vulnerability stems from the lack of proper initialization of memory prior to accessing it in the BusLogicSCSI component. It has been assigned a CVSS v3.1 Base Score of 6.0 (Confidentiality impacts) with the vector string: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. This indicates that the vulnerability requires local access and high privileges to exploit, but can potentially lead to significant confidentiality impacts (NVD).

A successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. The vulnerability specifically impacts the confidentiality of the system, with no direct effects on integrity or availability (ZDI Advisory).

The vulnerability requires an attacker to first obtain high-privileged access to execute code on the target guest system. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute code in the context of the hypervisor (ZDI Advisory).

Oracle has released patches to address this vulnerability in VirtualBox versions 5.2.44, 6.0.24, and 6.1.12. Users are strongly recommended to upgrade to these or later versions. The fix was included in Oracle's July 2020 Critical Patch Update (Oracle CPU, OpenSUSE Advisory).