CVE-2022-39423: 
VirtualBox vulnerability analysis and mitigation

A vulnerability (CVE-2022-39423) was identified in Oracle VM VirtualBox's Core component affecting versions prior to 6.1.38. This vulnerability allows high-privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system (Oracle CPU). The vulnerability was discovered by Billy Jheng Bing-Jhong working with Trend Micro Zero Day Initiative (ZDI Advisory).

The vulnerability exists within the sosendoob method and results from the lack of proper validation of user-supplied data, which can lead to a read past the end of an allocated object. The vulnerability has been assigned a CVSS v3.1 base score of 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) (ZDI Advisory).

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. The vulnerability specifically impacts the confidentiality of the system, with no direct effects on integrity or availability (Oracle CPU).

Oracle has released a patch for this vulnerability in VirtualBox version 6.1.38. Users are advised to upgrade to this version or later to address the security issue. Given the nature of the vulnerability, the only effective mitigation strategy prior to patching is to restrict interaction with the application (ZDI Advisory, Gentoo Advisory).