PT-2021-3253 · Oracle+1 · Virtualbox+1

Billy Jheng Bing-Jhong

+5

·

Published

2021-04-22

·

Updated

2021-08-26

·

CVE-2021-2321

CVSS v3.1

6.0

Medium

VectorAV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions prior to 6.1.20
Description The issue is related to a buffer read operation that can lead to unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. It affects the Core component of Oracle VM VirtualBox and can be exploited by a high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes. Successful attacks may significantly impact additional products.
Recommendations For versions prior to 6.1.20, update to version 6.1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Fix

Out of bounds Read

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2021-1692
ALT-PU-2021-1693
ALT-PU-2021-1694
ALT-PU-2021-1695
ALT-PU-2021-1696
ALT-PU-2021-1740
ALT-PU-2021-1741
ALT-PU-2021-1742
ALT-PU-2021-2630
ALT-PU-2021-2631
ALT-PU-2021-2632
ALT-PU-2021-2633
ALT-PU-2021-2634
BDU:2021-02979
CVE-2021-2321
ZDI-21-483

Affected Products

Alt Linux
Virtualbox