PT-2022-2012 · Oracle+1 · Virtualbox+1

Aobo Wang + 1 · Published 2022-01-19 · Updated 2023-08-07 · CVE-2022-21295

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions prior to 6.1.32

Description The issue allows a low-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox, potentially impacting additional products. Successful attacks can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. This issue applies to Windows systems only.

Recommendations For versions prior to 6.1.32, update to version 6.1.32 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and limiting user privileges on the system where Oracle VM VirtualBox is executed.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2022-1082

ALT-PU-2022-1083

ALT-PU-2022-1084

ALT-PU-2022-1085

ALT-PU-2022-1086

ALT-PU-2022-1182

ALT-PU-2022-1183

ALT-PU-2022-1184

ALT-PU-2022-1185

ALT-PU-2022-1186

ALT-PU-2023-4088

ALT-PU-2023-4089

ALT-PU-2023-4090

ALT-PU-2023-4664

ALT-PU-2023-4665

ALT-PU-2023-4729

ALT-PU-2023-4730

BDU:2022-01603

CVE-2022-21295

MGASA-2022-0038

Affected Products

Alt Linux

Virtualbox

References · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21295 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21295 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21295 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21295 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21295 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0038.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21395 · Security Note
• https://bdu.fstec.ru/vul/2022-01603 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0038 · Vendor Advisory
• https://virtualbox.org/wiki/Changelog-6.1#v32 · Note
• https://oracle.com/security-alerts/cpujan2022.html#AppendixOVIR · Note
• https://t.me/cibsecurity/35828 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21295 · Note
• https://bugs.mageia.org/show_bug.cgi?id=29918 · Note