CVE-2023-21998: 
VirtualBox vulnerability analysis and mitigation

A vulnerability has been identified in Oracle VM VirtualBox (CVE-2023-21998) affecting versions prior to 6.1.44 and prior to 7.0.8. This vulnerability was discovered by Kun Yang of Chaitin Security Research Lab and disclosed in April 2023. The vulnerability specifically affects Windows VMs running on Oracle VM VirtualBox (Oracle Advisory).

The vulnerability is characterized as easily exploitable and requires a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes. It has been assigned a CVSS 3.1 Base Score of 4.6 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. This indicates local access is required, with low attack complexity, high privileges needed, no user interaction required, and the scope is changed (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data, as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data. While the vulnerability exists in Oracle VM VirtualBox, attacks may significantly impact additional products due to scope change (NVD).

Oracle has released patches to address this vulnerability in VirtualBox versions 6.1.44 and 7.0.8. Users are strongly advised to upgrade to these or later versions to mitigate the vulnerability (Oracle Advisory).