CVE-2021-2126: 
VirtualBox vulnerability analysis and mitigation

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core) affects versions prior to 6.1.18. This vulnerability was disclosed in January 2021 as part of Oracle's Critical Patch Update (Oracle Advisory). The vulnerability allows high privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system (NVD).

The vulnerability has a CVSS v3.1 Base Score of 6.0 (Medium) with the vector string: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N. This indicates a local attack vector requiring high privileges but no user interaction, with impacts primarily to integrity across security boundaries (NVD).

Successful exploitation can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (Oracle Advisory).

The vulnerability is considered easily exploitable but requires high privileges and local access to the infrastructure where Oracle VM VirtualBox executes (NVD).

Oracle released version 6.1.18 to address this vulnerability. Users should upgrade to this version or later to mitigate the risk (Gentoo Advisory).