CVE-2021-2283: 
VirtualBox vulnerability analysis and mitigation

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version affected is Prior to 6.1.20. This vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data (Oracle Advisory).

The vulnerability has been assigned a CVSS 3.1 Base Score of 7.1 (Confidentiality impacts) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. The attack vector is Local (AV:L), with Low attack complexity (AC:L), requiring No privileges (PR:N), No user interaction (UI:N), with Changed scope (S:C), and High confidentiality impact (C:H) but No impact on integrity (I:N) or availability (A:N) (Oracle Advisory).

The vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. The scope of the impact extends beyond the vulnerable component, potentially affecting additional products (Oracle Advisory).

Oracle has released version 6.1.20 of VirtualBox to address this vulnerability. Users should upgrade to this version or later to mitigate the risk. The fix was included in the April 2021 Critical Patch Update (Oracle Advisory, Gentoo Advisory).