CVE-2022-39421: 
VirtualBox vulnerability analysis and mitigation

CVE-2022-39421 is a vulnerability in Oracle VM VirtualBox's Core component affecting versions prior to 6.1.40. The vulnerability was discovered by Dohyun Lee (l33d0hyun) of SecuriTeam Secure Disclosure Labs and was disclosed in Oracle's October 2022 Critical Patch Update (Oracle CPU).

This vulnerability is easily exploitable and requires a low-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes. The vulnerability has a CVSS v3.1 Base Score of 7.3, indicating high severity. The attack vector is Local (L), with Low attack complexity, requiring Low privileges and user interaction. The scope is Unchanged, with High impact on Confidentiality, Integrity, and Availability (CVE Details).

Successful exploitation of this vulnerability can result in complete takeover of Oracle VM VirtualBox. The vulnerability affects Windows systems only and requires human interaction from a person other than the attacker (Oracle CPU).

The primary mitigation is to upgrade to Oracle VM VirtualBox version 6.1.40 or later. This was confirmed in the Gentoo Linux Security Advisory, which also recommended users to upgrade their VirtualBox modules to the same version (Gentoo Security).