CVE-2020-14889: 
VirtualBox vulnerability analysis and mitigation

A vulnerability was identified in Oracle VM VirtualBox (CVE-2020-14889) affecting versions prior to 6.1.16. The vulnerability was disclosed in Oracle's October 2020 Critical Patch Update. This is a high-privileged vulnerability that allows attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system (Oracle CPU Oct 2020).

The vulnerability has a CVSS v3.1 Base Score of 6.0 (MEDIUM) with the following vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. This indicates a local attack vector requiring high privileges with no user interaction needed. The scope is changed, and the vulnerability impacts confidentiality but not integrity or availability (NVD).

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. The vulnerability specifically impacts the confidentiality of data while integrity and availability remain unaffected (Oracle CPU Oct 2020).

The vulnerability is considered easily exploitable but requires high privileges and local access to the infrastructure where Oracle VM VirtualBox executes. While the vulnerability exists in Oracle VM VirtualBox, attacks may significantly impact additional products (Oracle CPU Oct 2020).

Oracle released a patch for this vulnerability in VirtualBox version 6.1.16. Users should upgrade to this version or later to address the vulnerability. Gentoo Linux users were advised to upgrade to virtualbox-6.1.18 or later versions for complete mitigation (Gentoo Security).