CVE-2020-2929: 
VirtualBox vulnerability analysis and mitigation

A vulnerability identified as CVE-2020-2929 was discovered in Oracle VM VirtualBox versions prior to 5.2.40, prior to 6.0.20, and prior to 6.1.6. The vulnerability was discovered by Pavel Cheremushkin and was publicly disclosed in Oracle's April 2020 Critical Patch Update (Oracle CPU).

The vulnerability exists within the implementation of NAT networking in VirtualBox's SLiRP component. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (ZDI Advisory).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the hypervisor, potentially compromising the host system. The vulnerability affects the confidentiality, integrity, and availability of the system (ZDI Advisory).

Oracle has released security patches to address this vulnerability in VirtualBox versions 5.2.40, 6.0.20, and 6.1.6. Users are strongly advised to upgrade to these or later versions to mitigate the vulnerability (Oracle CPU).