CVE-2020-2911: 
VirtualBox vulnerability analysis and mitigation

CVE-2020-2911 is a vulnerability affecting Oracle VM VirtualBox versions prior to 5.2.40, prior to 6.0.20, and prior to 6.1.6. The vulnerability exists within the vmsvga3dSetLightData function and is classified as difficult to exploit, requiring a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes (Oracle Advisory, ZDI Advisory).

The vulnerability stems from the lack of proper validation of user-supplied data in the vmsvga3dSetLightData function, which can result in a write past the end of an allocated buffer. The vulnerability has been assigned a CVSS 3.0 Base Score of 7.5 (HIGH) with the following vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H (ZDI Advisory, NVD).

A successful exploitation of this vulnerability can result in takeover of Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. The vulnerability affects confidentiality, integrity, and availability of the system (NVD).

Oracle has released patches to address this vulnerability. Users should upgrade to VirtualBox versions 5.2.40, 6.0.20, or 6.1.6 or later depending on their current version. The fix was included in Oracle's April 2020 Critical Patch Update (Oracle Advisory).