PT-2024-5869 · Oracle+2 · Virtualbox+2

Derek Schrock + 1 · Published 2024-07-16 · Updated 2025-10-10 · CVE-2024-21161

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions prior to 7.0.20

Description The issue is related to errors in resource release in the Core component of Oracle VM VirtualBox, allowing a low-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox. This issue applies to Linux hosts only.

Recommendations For versions prior to 7.0.20, update to version 7.0.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation. Additionally, ensure that Oracle VM VirtualBox is running with the least privileges necessary to reduce the impact of a potential attack.

Fix

DoS

Resource Exhaustion

Improper Resource Release

Weakness Enumeration

CWE-400

CWE-404

Related Identifiers

ALT-PU-2024-14700

ALT-PU-2024-14702

ALT-PU-2024-14703

ALT-PU-2024-15438

ALT-PU-2024-15440

ALT-PU-2024-15441

ALT-PU-2024-15442

ALT-PU-2024-15443

ALT-PU-2024-15782

ALT-PU-2024-15784

ALT-PU-2025-12585

ALT-PU-2025-12587

ALT-PU-2025-12588

ALT-PU-2025-12589

ALT-PU-2025-12590

BDU:2024-06651

CVE-2024-21161

MGASA-2024-0275

Affected Products

Alt Linux

Virtualbox

Red Os

References · 17

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-21161 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06651 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21161 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0275.html · Security Note
• https://oracle.com/security-alerts/cpujul2024.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-21161 · Security Note
• https://osv.dev/vulnerability/MGASA-2024-0275 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21161 · Security Note
• https://ubuntu.com/security/CVE-2024-21161 · Vendor Advisory
• https://redos.red-soft.ru/support/secure · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21161 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-virtualbox-cve-2024-21161-cve-2024-21164-cve-2024-21141 · Note
• https://oracle.com/security-alerts/cpujul2024.html#AppendixOVIR · Note
• https://bugs.mageia.org/show_bug.cgi?id=33408 · Note
• https://virtualbox.org/wiki/Changelog-7.0#v20 · Note