CVE-2023-22099: 
VirtualBox vulnerability analysis and mitigation

A vulnerability in Oracle VM VirtualBox (CVE-2023-22099) affects versions prior to 7.0.12. This vulnerability was disclosed in October 2023 as part of Oracle's Critical Patch Update. The vulnerability exists in the Core component of Oracle VM VirtualBox and is considered easily exploitable by high-privileged attackers who have logon access to the infrastructure where Oracle VM VirtualBox executes (Oracle CPU).

The vulnerability has been assigned a CVSS 3.1 Base Score of 8.2 (High) with the following vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The scoring indicates that the vulnerability requires local access (AV:L), is low complexity (AC:L), requires high privileges (PR:H), needs no user interaction (UI:N), has changed scope (S:C), and can impact confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD).

Successful exploitation of this vulnerability can result in complete takeover of Oracle VM VirtualBox. While the vulnerability exists within VirtualBox itself, attacks may significantly impact additional products due to scope change. The high CVSS score reflects the severe potential impact on the confidentiality, integrity, and availability of the system (Oracle CPU).

Oracle has released version 7.0.12 to address this vulnerability. Users running affected versions of Oracle VM VirtualBox (prior to 7.0.12) should update to the latest version immediately (ASEC).