CVE-2023-21885: 
VirtualBox vulnerability analysis and mitigation

CVE-2023-21885 affects Oracle VM VirtualBox versions prior to 6.1.42 and prior to 7.0.6. This vulnerability allows low privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability was discovered by Aobo Wang of Chaitin Security Research Lab and was disclosed in January 2023 (Oracle Advisory).

The vulnerability is a heap buffer overflow in XISendDeviceHierarchyEvent component of Oracle VM VirtualBox. It has been assigned a CVSS 3.1 Base Score of 3.8 (Confidentiality impacts) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. The vulnerability only affects Windows platforms (NVD).

Successful exploitation of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products due to scope change (Oracle Advisory).

Oracle has released security patches to address this vulnerability in VirtualBox versions 6.1.42 and 7.0.6. Users are strongly recommended to upgrade to these or later versions. Gentoo Linux users should upgrade to virtualbox-7.0.6 or virtualbox-6.1.46 (Gentoo Advisory).