CVE-2021-2297: 
VirtualBox vulnerability analysis and mitigation

A vulnerability (CVE-2021-2297) was discovered in Oracle VM VirtualBox's Core component affecting versions prior to 6.1.20. This vulnerability is classified as difficult to exploit and requires a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes (Oracle Advisory, ZDI Advisory).

The vulnerability exists within the implementation of the LsiLogic virtual device and results from the lack of proper locking when performing operations on an object. It has been assigned a CVSS v3.1 base score of 5.3 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) indicating high complexity and high privileges required for exploitation (ZDI Advisory).

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (Oracle Advisory).

The vulnerability is considered difficult to exploit and requires an attacker to first obtain the ability to execute high-privileged code on the target guest system. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor (ZDI Advisory).

Oracle has released version 6.1.20 of VirtualBox to address this vulnerability. Users are strongly recommended to upgrade to this version or later (Oracle Advisory, Gentoo Advisory).