CVE-2023-21990: 
VirtualBox vulnerability analysis and mitigation

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core) affects versions prior to 6.1.44 and prior to 7.0.8. This vulnerability allows high privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability was discovered and reported by Dungdm (piers2) of Viettel Cyber Security working with Trend Micro's Zero Day Initiative (Oracle Advisory, ZDI Advisory).

The specific flaw exists within the OHCI USB controller. The issue results from the lack of validating the existence of an object prior to performing operations on the object. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.2 (High) with the vector string: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (ZDI Advisory, NVD).

Successful exploitation of this vulnerability can result in takeover of Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products due to scope change. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor (ZDI Advisory).

Oracle has issued an update to correct this vulnerability. Users should upgrade to Oracle VM VirtualBox version 6.1.44 or 7.0.8 or later versions (Oracle Advisory).