Expert discloses details of flaws in Oracle VirtualBox

guest · Nov 24, 2021

Expert discloses details of flaws in Oracle VirtualBox
November 24, 2021
https://securityaffairs.co/wordpress/124944/security/oracle-virtualbox-flaws.html

A vulnerability in Oracle VM VirtualBox, tracked as CVE-2021-2442, could be potentially exploited to compromise the hypervisor and trigger a DoS condition. The vulnerability was discovered by Max Van Amerongen from SentinelLabs, it received a CVSS score of 6.0 and affects versions prior to 6.1.24.

Got another Virtualbox vuln fixed (CVE-2021-2442)
Works as both an OOB read in the host process, as well as an integer underflow. In some instances, it can also be used to remotely DoS other Virtualbox VMs! pic.twitter.com/Ir9YQgdZQ7
— maxpl0it (@maxpl0it) August 1, 2021
Click to expand...

“Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.” reads the advisory published by NIST.
Click to expand...

The CVE-2021-2442 vulnerability was addressed by Oracle in July with the release of Critical Patch Update.

Amerongen also discovered other two vulnerabilities tracked as CVE-2021-2145 and CVE-2021-2310 respectively.
The CVE-2021-2145 is an integer underflow privilege escalation vulnerability in Oracle VirtualBox NAT, while the CVE-2021-2310 is a heap-based buffer overflow privilege escalation vulnerability in Oracle VirtualBox NAT.
Click to expand...

SentinelLabs: GSOh No! Hunting for Vulnerabilities in VirtualBox Network Offloads

The Pwn2Own contest is like Christmas for me. It’s an exciting competition which involves rummaging around to find critical vulnerabilities in the most commonly used (and often the most difficult) software in the world. Back in March, I was preparing to have a pop at the Vancouver contest and had decided to take a break from writing browser fuzzers to try something different: VirtualBox.
Click to expand...

Log in or Sign up

Expert discloses details of flaws in Oracle VirtualBox

guest Guest

Log in or Sign up

Expert discloses details of flaws in Oracle VirtualBox

guest Guest

Useful Searches