CVE-2024-21113: 
VirtualBox vulnerability analysis and mitigation

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core) affects versions prior to 7.0.16. This easily exploitable vulnerability allows low privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The vulnerability was discovered by dungdm(@_piers2) of Viettel Cyber Security working with Trend Micro's Zero Day Initiative (Oracle CPU, ZDI Advisory).

The specific flaw exists within the implementation of the E1000 virtual device. The issue results from the lack of proper initialization of memory prior to accessing it. The vulnerability has a CVSS 3.1 Base Score of 8.8 (High) with the vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating local access required, low attack complexity, low privileges required, no user interaction needed, with high impacts to confidentiality, integrity and availability (ZDI Advisory).

Successful exploitation of this vulnerability can result in takeover of Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products due to scope change. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the hypervisor (Oracle CPU, ZDI Advisory).

The vulnerability requires a local attacker with low privileges to have logon access to the infrastructure where Oracle VM VirtualBox executes. The attacker must first obtain the ability to execute high-privileged code on the target guest system to exploit this vulnerability (ZDI Advisory).

Oracle has issued an update to correct this vulnerability in VirtualBox version 7.0.16. Users should upgrade to this version or later to mitigate the vulnerability (ZDI Advisory).