CVE-2022-21488: 
VirtualBox vulnerability analysis and mitigation

CVE-2022-21488 is a vulnerability discovered in Oracle VM VirtualBox prior to version 6.1.34. This easily exploitable vulnerability allows low-privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability was disclosed in April 2022 as part of Oracle's Critical Patch Update (Oracle Advisory).

The vulnerability has been assigned a CVSS 3.1 Base Score of 3.8 (Low severity) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N. This indicates that the vulnerability requires local access, low attack complexity, low privileges, and no user interaction. While the vulnerability scope is changed, it only affects integrity with low impact and has no impact on confidentiality or availability (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products due to the scope change characteristic (NVD).

The vulnerability has been patched in Oracle VM VirtualBox version 6.1.34. Users are strongly advised to upgrade to this version or later. For Gentoo Linux users, the fix is available in version 6.1.36 and can be applied through the package manager (Gentoo Advisory).