Yuhao Jiang

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions 7.1.14 and 7.2.4 **Description** An easily exploitable issue exists in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). A high-privileged attacker with access to the system where Oracle VM VirtualBox runs can compromise the software. Successful exploitation may lead to unauthorized read access to some Oracle VM VirtualBox data and a partial denial of service. Attacks may impact additional products. **Recommendations** Update Oracle VM VirtualBox to a version later than 7.1.14. Update Oracle VM VirtualBox to a version later than 7.2.4.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 7.0.24 Oracle VM VirtualBox versions prior to 7.1.6 **Description** The issue allows a high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle VM VirtualBox accessible data, as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service of Oracle VM VirtualBox. The vulnerability is related to the Core component of Oracle VM VirtualBox and may significantly impact additional products. **Recommendations** For Oracle VM VirtualBox versions prior to 7.0.24, update to version 7.0.24 or later. For Oracle VM VirtualBox versions prior to 7.1.6, update to version 7.1.6 or later. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** VMware ESXi, Workstation, and Fusion (affected versions not specified) **Description** A heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI) allows a malicious actor with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox, whereas on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed. The vulnerability was demonstrated at the GeekPwn 2022 hacking contest and has been used to escape the virtual machine. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.