PT-2023-1246 · Oracle+2 · Virtualbox+2

Aobo Wang

+1

·

Published

2023-01-17

·

Updated

2024-06-15

·

CVE-2023-21899

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions prior to 6.1.42 Oracle VM VirtualBox versions prior to 7.0.6
Description The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, which can be exploited by a low-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes. Successful attacks can result in the ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox, leading to a denial of service. This issue applies to VirtualBox VMs running Windows 7 and later.
Recommendations For Oracle VM VirtualBox versions prior to 6.1.42, update to version 6.1.42 or later. For Oracle VM VirtualBox versions prior to 7.0.6, update to version 7.0.6 or later. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2023-1071
ALT-PU-2023-1072
ALT-PU-2023-1073
ALT-PU-2023-1074
ALT-PU-2023-1075
ALT-PU-2023-1639
ALT-PU-2023-1640
ALT-PU-2023-1641
ALT-PU-2023-1642
ALT-PU-2023-1643
ALT-PU-2023-4088
ALT-PU-2023-4089
ALT-PU-2023-4090
ALT-PU-2023-4664
ALT-PU-2023-4665
ALT-PU-2023-4729
ALT-PU-2023-4730
BDU:2023-00507
CVE-2023-21899
OPENSUSE-SU-2023:0033-1
OPENSUSE-SU-2023_0033-1
OPENSUSE-SU-2024:12640-1

Affected Products

Alt Linux
Virtualbox
Suse