PT-2020-1355 · Oracle+1 · Virtualbox+1

Davide Berardi · Published 2020-01-14 · Updated 2021-02-25 · CVE-2020-2703

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions prior to 5.2.36 Oracle VM VirtualBox versions prior to 6.0.16

Description The issue is related to errors in resource release in the Core component of Oracle VM VirtualBox. Exploitation of this issue can allow an attacker to cause a denial of service. A low-privileged attacker with login access to the infrastructure where Oracle VM VirtualBox runs can compromise Oracle VM VirtualBox. Although the issue occurs in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox.

Recommendations For Oracle VM VirtualBox versions prior to 5.2.36, update to version 5.2.36 or later. For Oracle VM VirtualBox versions prior to 6.0.16, update to version 6.0.16 or later. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

ALT-PU-2020-1123

ALT-PU-2020-1124

ALT-PU-2020-1125

ALT-PU-2020-1126

ALT-PU-2020-1127

ALT-PU-2020-1436

ALT-PU-2020-1437

ALT-PU-2020-1438

ALT-PU-2020-1439

ALT-PU-2020-1440

BDU:2020-00281

CVE-2020-2703

MGASA-2020-0065

Affected Products

Alt Linux

Virtualbox

References · 17

• https://osv.dev/vulnerability/MGASA-2020-0065 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2703 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-2703 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0065.html · Security Note
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2703 · Security Note
• https://bdu.fstec.ru/vul/2020-00281 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-2703 · Vendor Advisory
• https://security.gentoo.org/glsa/202101-09 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-2703 · Security Note
• https://security.gentoo.org/glsa/202004-02 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2703 · Note
• https://bugs.mageia.org/show_bug.cgi?id=26079 · Note
• https://oracle.com/security-alerts/cpujan2020.html#AppendixOVIR · Note
• https://virtualbox.org/wiki/Changelog-6.0#v16 · Note