CVE-2022-21620: 
VirtualBox vulnerability analysis and mitigation

Oracle VM VirtualBox, prior to version 6.1.40, contains a vulnerability (CVE-2022-21620) that affects the Core component. This vulnerability was discovered by Kun Yang and Lu Yu of Chaitin Security Research Lab (Oracle CPU Oct 2022). The issue was disclosed in October 2022 and requires a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (High) with the following vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. This indicates that the vulnerability requires local access, high complexity to exploit, and high privileges, but requires no user interaction. The scope is changed, and successful exploitation could result in high impacts to confidentiality, integrity, and availability (NVD).

Successful exploitation of this vulnerability can result in a complete takeover of Oracle VM VirtualBox. While the vulnerability exists within VirtualBox itself, attacks may significantly impact additional products due to the scope change characteristic (NVD).

The vulnerability has been patched in Oracle VM VirtualBox version 6.1.40. Users are advised to upgrade to this version or later. For Gentoo users, the fix is available through package updates to app-emulation/virtualbox-6.1.40 and app-emulation/virtualbox-modules-6.1.40 (Gentoo Security).