CVE-2020-2909: 
VirtualBox vulnerability analysis and mitigation

CVE-2020-2909 is a vulnerability in Oracle VM VirtualBox affecting versions prior to 5.2.40, prior to 6.0.20, and prior to 6.1.6. The vulnerability was disclosed in Oracle's April 2020 Critical Patch Update. It is characterized as an easily exploitable vulnerability that allows low-privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system (Oracle CPU, NVD).

The vulnerability has been assigned a CVSS 3.0 Base Score of 2.8 (LOW) with the following vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L. The attack requires local access, has low attack complexity, requires low privileges, and needs user interaction. The scope is unchanged, with no impact on confidentiality or integrity, but has a low impact on availability (NVD).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (NVD).

Oracle released patches for this vulnerability in VirtualBox versions 5.2.40, 6.0.20, and 6.1.6. Users are advised to upgrade to these or later versions. The fix was included in the April 2020 Critical Patch Update (Oracle CPU, OpenSUSE).