CVE-2020-2908: 
VirtualBox vulnerability analysis and mitigation

CVE-2020-2908 is a vulnerability affecting Oracle VirtualBox versions prior to 5.2.40, prior to 6.0.20, and prior to 6.1.6. The vulnerability was discovered and reported by Reno Robert working with Trend Micro Zero Day Initiative, and was publicly disclosed in April 2020 (Oracle CPU).

The vulnerability exists within the virtual USB component of VirtualBox. The specific flaw results from the lack of proper validation of guest-supplied data, which can result in a write past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) (ZDI Advisory).

A successful exploitation of this vulnerability could allow an attacker to escalate privileges and execute code in the context of the hypervisor. This means an attacker could potentially gain control over the host system from within a guest virtual machine (ZDI Advisory).

Oracle has released security patches to address this vulnerability. Users should upgrade to VirtualBox version 5.2.40 or later, 6.0.20 or later, or 6.1.6 or later, depending on their current version branch (Oracle CPU).