CVE-2024-21110: 
VirtualBox vulnerability analysis and mitigation

CVE-2024-21110 affects Oracle VM VirtualBox versions prior to 7.0.16. This vulnerability in the Core component allows low privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability requires human interaction from a person other than the attacker to be successfully exploited (Oracle CPU).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.3 (High) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. This indicates Local access vector, Low attack complexity, Low privileges required, User interaction required, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability (Oracle CPU).

Successful exploitation of this vulnerability can result in complete takeover of Oracle VM VirtualBox, potentially compromising the confidentiality, integrity, and availability of the system (Oracle CPU).

The vulnerability is considered easily exploitable but requires both low-privileged access to the infrastructure where Oracle VM VirtualBox executes and human interaction from a person other than the attacker. The specific flaw exists within Guest Additions and results from improper access control when performing upgrade operations (ZDI Advisory).

Oracle has released version 7.0.16 to address this vulnerability. Users are strongly advised to update to this version or later to mitigate the risk (Oracle CPU).