CVE-2021-2124: 
VirtualBox vulnerability analysis and mitigation

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. This vulnerability was discovered in January 2021 and affects the core component of VirtualBox virtualization software (Oracle Advisory, Gentoo Advisory).

The vulnerability allows high privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability has a CVSS 3.1 Base Score of 6.0 (Availability impacts) with the vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H (Oracle Advisory).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (Oracle Advisory).

The vulnerability is considered easily exploitable but requires high privileges and local access to the infrastructure where VirtualBox executes. No user interaction is required for exploitation (Oracle Advisory).

The vulnerability was addressed in VirtualBox version 6.1.18. Users should upgrade to this version or later to mitigate the risk. For Gentoo users, the recommended mitigation is to upgrade using the command: emerge --ask --oneshot --verbose ">=app-emulation/virtualbox-6.1.18" (Gentoo Advisory).