CVE-2020-2575: 
VirtualBox vulnerability analysis and mitigation

CVE-2020-2575 is a vulnerability affecting Oracle VM VirtualBox that was disclosed in April 2020. The vulnerability allows high-privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. This vulnerability affects VirtualBox versions prior to 5.2.40, prior to 6.0.20, and prior to 6.1.6 (Oracle CPU).

The vulnerability exists within the processing of data sent to OHCI endpoints. The specific flaw results from the lack of proper initialization of memory prior to accessing it. The vulnerability has a CVSS v3.0 Base Score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (ZDI Advisory).

A successful exploitation of this vulnerability could allow an attacker to leverage this flaw in conjunction with other vulnerabilities to execute code in the context of the hypervisor, potentially leading to complete compromise of the system (ZDI Advisory).

The vulnerability requires an attacker to first obtain the ability to execute high-privileged code on the target guest system. While the vulnerability is difficult to exploit, it provides significant privileges once successfully exploited (ZDI Advisory).

Oracle has released security patches to address this vulnerability. Users should upgrade to VirtualBox versions 5.2.40, 6.0.20, or 6.1.6 or later depending on their current version track (Oracle CPU).