CVE-2024-21106: 
VirtualBox vulnerability analysis and mitigation

A vulnerability has been identified in Oracle VM VirtualBox (CVE-2024-21106) affecting versions prior to 7.0.16. This vulnerability was discovered by Reima Ishii of Graduate School of Information Science and Technology, The University of Tokyo (Oracle CPU).

The vulnerability exists in the Core component of Oracle VM VirtualBox. It is characterized as an easily exploitable vulnerability that allows a low-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability has been assigned a CVSS 3.1 Base Score of 6.5 with the vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H (NVD).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash, leading to a complete denial of service (DOS) of Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products due to scope change (Oracle CPU).

The vulnerability is considered easily exploitable and requires a low-privileged attacker to have logon access to the infrastructure where Oracle VM VirtualBox executes. No user interaction is required for exploitation (NVD).

Oracle has released version 7.0.16 to address this vulnerability. Users are strongly advised to upgrade to this version to mitigate the risk. Oracle recommends that customers remain on actively-supported versions and apply Critical Patch Update security patches without delay (Oracle CPU).