PT-2023-3641 · Oracle+2 · Virtualbox+2

Kn32 · Published 2023-07-18 · Updated 2023-12-07 · CVE-2023-22018

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions prior to 6.1.46 Oracle VM VirtualBox versions prior to 7.0.10

Description The issue is related to errors in resource release in the Core component of Oracle VM VirtualBox. It can be exploited by a remote attacker to execute arbitrary code or gain full control over the application using the RDP protocol. Successful attacks can result in the takeover of Oracle VM VirtualBox. The vulnerability can be difficult to exploit and allows an unauthenticated attacker with network access via RDP to compromise the system.

Recommendations For versions prior to 6.1.46, update to version 6.1.46 or later. For versions prior to 7.0.10, update to version 7.0.10 or later. As a temporary workaround, consider restricting access to the RDP protocol until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2023-4923

ALT-PU-2023-4924

ALT-PU-2023-4925

ALT-PU-2023-4926

ALT-PU-2023-4927

ALT-PU-2023-4928

ALT-PU-2023-4929

ALT-PU-2023-4930

ALT-PU-2023-4931

ALT-PU-2023-4932

ALT-PU-2023-5232

ALT-PU-2023-5233

ALT-PU-2023-5234

ALT-PU-2023-5235

ALT-PU-2023-5236

ALT-PU-2023-7554

ALT-PU-2023-7555

ALT-PU-2023-7556

ALT-PU-2023-7557

ALT-PU-2023-7558

BDU:2023-03925

CVE-2023-22018

MGASA-2023-0239

ZDI-23-982

Affected Products

Alt Linux

Virtualbox

Red Os

References · 16

• https://osv.dev/vulnerability/CVE-2023-22018 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22018 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0239 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0239.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-22018 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-22018 · Security Note
• https://bdu.fstec.ru/vul/2023-03925 · Security Note
• https://oracle.com/security-alerts/cpujul2023.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-982 · Security Note
• https://ubuntu.com/security/CVE-2023-22018 · Vendor Advisory
• https://t.me/opennews/11707 · Telegram Post
• https://bugs.mageia.org/show_bug.cgi?id=32124 · Note
• https://oracle.com/security-alerts/cpujul2023.html#AppendixOVIR · Note
• https://virtualbox.org/wiki/Changelog-7.0#v10 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-virtualbox-cve-2023-22018 · Note