CVE-2021-2250: 
VirtualBox vulnerability analysis and mitigation

Oracle VM VirtualBox, prior to version 6.1.20, contained a vulnerability (CVE-2021-2250) that affects the Core component. The vulnerability was discovered and disclosed in April 2021 as part of Oracle's Critical Patch Update (Oracle CPU).

The vulnerability exists within the parsing of ICMP messages in the SLiRP networking component. The specific flaw results from the lack of proper validation of guest-supplied data, which can result in a heap-based buffer overflow - specifically, a write past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 with the vector: AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H (ZDI Advisory).

A successful exploitation of this vulnerability can result in takeover of Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. The vulnerability allows attackers to escalate privileges and execute arbitrary code in the context of the hypervisor (Oracle CPU, ZDI Advisory).

The vulnerability is considered easily exploitable but requires a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes. An attacker must first obtain the ability to execute high-privileged code on the target guest system to exploit this vulnerability (Oracle CPU, ZDI Advisory).

Oracle has released version 6.1.20 of VirtualBox to address this vulnerability. Users are strongly recommended to upgrade to this version or later. The fix was included in Oracle's April 2021 Critical Patch Update (Oracle CPU, Gentoo Advisory).