CVE-2021-2281: 
VirtualBox vulnerability analysis and mitigation

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core) affects versions prior to 6.1.20. This easily exploitable vulnerability allows unauthenticated attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability was disclosed in April 2021 as part of Oracle's Critical Patch Update (Oracle CPU).

The vulnerability has been assigned a CVSS 3.1 Base Score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. The scoring indicates that while local access is required, no privileges or user interaction are needed to exploit the vulnerability, and it can have significant integrity impacts on the system (Oracle CPU).

Successful exploitation of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (Oracle CPU).

Oracle has released a patch for this vulnerability in VirtualBox version 6.1.20. Users are strongly recommended to upgrade to this version or later to address the security issue. For Gentoo Linux users, the fix is available in version 6.1.36 and users should upgrade using the package manager (Gentoo Advisory).