CVE-2021-2120: 
VirtualBox vulnerability analysis and mitigation

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core) affects versions prior to 6.1.18. This easily exploitable vulnerability allows high-privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability was disclosed in January 2021 and assigned CVE-2021-2120 (Oracle Advisory).

The vulnerability has a CVSS 3.1 Base Score of 6.0, focusing on confidentiality impacts. The CVSS Vector is (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), indicating local access vector, low attack complexity, high privileges required, no user interaction needed, changed scope, and high confidentiality impact (NVD).

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (Oracle Advisory).

The vulnerability requires a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes. The attack complexity is considered low, but the attacker must already have high privileges on the system (NVD).

Oracle has released security patches to address this vulnerability. Users should upgrade to VirtualBox version 6.1.18 or later to mitigate the risk. This is confirmed by both Oracle's advisory and Gentoo's security advisory (Gentoo Advisory).

The vulnerability was discovered and reported by ChenNan of Chaitin Security Research Lab, along with several other VirtualBox vulnerabilities. The discovery was part of a broader security research effort that identified multiple vulnerabilities in Oracle products (Oracle Advisory).