CVE-2021-2285: 
VirtualBox vulnerability analysis and mitigation

CVE-2021-2285 is a vulnerability affecting Oracle VM VirtualBox versions prior to 6.1.20. This easily exploitable vulnerability allows unauthenticated attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability was disclosed in Oracle's April 2021 Critical Patch Update (Oracle CPU).

The vulnerability has a CVSS 3.1 Base Score of 7.1 (High) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. This indicates a local attack vector with low attack complexity, requiring no privileges or user interaction, with scope changed and high impact on confidentiality but no impact on integrity or availability (NVD).

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data (Oracle CPU).

The vulnerability is considered easily exploitable and requires logon access to the infrastructure where Oracle VM VirtualBox executes. No authentication is required beyond the local system access (NVD).

Oracle released a patch for this vulnerability in VirtualBox version 6.1.20. Users should upgrade to this version or later to address the vulnerability. The fix was included in Oracle's April 2021 Critical Patch Update (Oracle CPU, Gentoo Advisory).

The vulnerability was discovered and reported by ChenNan and Kun Yang of Chaitin Security Research Lab, as acknowledged in Oracle's April 2021 Critical Patch Update (Oracle CPU).