CVE-2021-2119: 
VirtualBox vulnerability analysis and mitigation

Vulnerability in Oracle VM VirtualBox (CVE-2021-2119) affects versions prior to 6.1.18. This vulnerability is part of the Core component of Oracle Virtualization. The issue was disclosed in January 2021 and allows high-privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system (Oracle Advisory).

The vulnerability has a CVSS 3.1 Base Score of 6.0 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. This indicates a local attack vector with low attack complexity, requiring high privileges, no user interaction, with a changed scope, and impacts only confidentiality (NVD).

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (Oracle Advisory).

The vulnerability is considered easily exploitable but requires a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes (NVD).

Oracle released version 6.1.18 of VirtualBox to address this vulnerability. Users are advised to upgrade to this version or later. For Gentoo users, the fix is available through package update to virtualbox-6.1.18 (Gentoo Advisory).