CVE-2020-2743: 
VirtualBox vulnerability analysis and mitigation

CVE-2020-2743 is a vulnerability in Oracle VM VirtualBox that was disclosed in April 2020. This vulnerability affects VirtualBox versions prior to 5.2.40, prior to 6.0.20, and prior to 6.1.6. The issue was discovered by Reno Robert working with Trend Micro Zero Day Initiative (Oracle CPU).

The vulnerability exists within the xHCI component of VirtualBox. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a read past the end of a stack buffer. The vulnerability has a CVSS score of 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) (ZDI Advisory).

A successful exploitation of this vulnerability can result in the disclosure of sensitive information on affected installations of Oracle VirtualBox. The vulnerability allows attackers to potentially leverage this in conjunction with other vulnerabilities to execute code in the context of the hypervisor (ZDI Advisory).

Oracle has released security patches to address this vulnerability. Users should upgrade to VirtualBox versions 5.2.40, 6.0.20, or 6.1.6 or later depending on their current version (Oracle CPU).