CVE-2020-14892: 
VirtualBox vulnerability analysis and mitigation

Vulnerability in Oracle VM VirtualBox (CVE-2020-14892) affects versions prior to 6.1.16. This vulnerability was discovered by Gaoning Pan of Zhejiang University & Ant Security Light-Year Lab, Xingwei Lin of Ant Security Light-Year Lab, and Xinlei Ying of Ant Security Light-Year Lab. The vulnerability was disclosed in Oracle's October 2020 Critical Patch Update (Oracle CPU).

The vulnerability allows low privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability has a CVSS 3.1 Base Score of 5.5 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. The vulnerability only affects availability, with no impact on confidentiality or integrity (Oracle CPU).

The vulnerability is considered easily exploitable and requires low attack complexity. The attacker needs local access and low privileges to execute the attack. No user interaction is required for exploitation (NVD).

Oracle has released a patch for this vulnerability in VirtualBox version 6.1.16. Users are strongly recommended to upgrade to this version or later to address the security issue. The fix is also included in the Oracle Critical Patch Update from October 2020 (Gentoo Security).