CVE-2021-2121: 
VirtualBox vulnerability analysis and mitigation

A vulnerability was identified in Oracle VM VirtualBox (component: Core) affecting versions prior to 6.1.18. The vulnerability was discovered and disclosed in January 2021 (Oracle Advisory, Gentoo Advisory). The issue affects the core functionality of Oracle VM VirtualBox and could potentially impact additional products beyond VirtualBox itself.

The vulnerability has been assigned a CVSS 3.1 Base Score of 6.0 (Availability impacts) with the following vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H. This indicates a local attack vector requiring high privileges, but no user interaction, with the potential to affect connected systems (Oracle Advisory).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. While the vulnerability is in VirtualBox, attacks may significantly impact additional products (Oracle Advisory).

The vulnerability is considered easily exploitable and requires a high privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes. The attack requires local access to the system running VirtualBox (Oracle Advisory).

Oracle has released version 6.1.18 of VirtualBox to address this vulnerability. Users are strongly advised to upgrade to this version or later. For Gentoo users, the recommendation is to upgrade using the command: emerge --sync followed by emerge --ask --oneshot --verbose ">=app-emulation/virtualbox-6.1.18" (Gentoo Advisory).