CVE-2023-21987: 
VirtualBox vulnerability analysis and mitigation

A vulnerability in Oracle VM VirtualBox (component: Core) affects versions prior to 6.1.44 and prior to 7.0.8. This difficult-to-exploit vulnerability allows low-privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability was disclosed in April 2023 (Oracle Advisory).

The vulnerability specifically exists within the handling of TPM MMIO (Memory-Mapped I/O). The issue stems from inadequate validation of the length of user-supplied data before copying it to a fixed-length stack-based buffer. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (High) with the following vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H (NVD, ZDI).

Successful exploitation of this vulnerability can result in complete takeover of Oracle VM VirtualBox. While the vulnerability is in VirtualBox, attacks may significantly impact additional products due to scope change. The vulnerability affects confidentiality, integrity, and availability of the system (NVD).

Oracle has released security updates to address this vulnerability in VirtualBox versions 6.1.44 and 7.0.8. Users are strongly advised to upgrade to these patched versions. The fix was included in Oracle's April 2023 Critical Patch Update (Oracle Advisory).