Login Sign Up

CVE-2021-2443

7.3 HIGH
Denial of Service

📋 TL;DR

This vulnerability in Oracle VM VirtualBox allows a high-privileged attacker with local access to cause denial of service, modify data, or read sensitive information. It affects Solaris x86 and Linux systems running VirtualBox versions prior to 6.1.24. The attack requires local access but can impact other products running on the same host.

💻 Affected Systems

Products:
  • Oracle VM VirtualBox
Versions: All versions prior to 6.1.24
Operating Systems: Solaris x86, Linux
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects Solaris x86 and Linux systems. Windows and macOS systems are not vulnerable.

📦 What is this software?

Vm Virtualbox by Oracle

View all CVEs affecting Vm Virtualbox →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete denial of service of VirtualBox, unauthorized data modification, and information disclosure affecting other products on the host system.

🟠

Likely Case

Local attackers with administrative privileges causing VirtualBox crashes and potentially accessing or modifying VirtualBox-managed data.

🟢

If Mitigated

Minimal impact if proper access controls limit local administrative privileges and VirtualBox is isolated from critical systems.

🌐 Internet-Facing: LOW - Requires local access to the host system, not remotely exploitable.
🏢 Internal Only: MEDIUM - Local attackers with high privileges can exploit this, but requires specific OS configurations (Solaris/Linux).

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW

Requires high-privileged local access (PR:H in CVSS). No public exploit code identified in references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 6.1.24 or later

Vendor Advisory: https://www.oracle.com/security-alerts/cpujul2021.html

Restart Required: Yes

Instructions:

1. Download VirtualBox 6.1.24 or later from Oracle website. 2. Stop all VirtualBox VMs and services. 3. Install the updated version. 4. Restart the host system.

🔧 Temporary Workarounds

Restrict local administrative access

linux

Limit the number of users with high privileges on affected Solaris/Linux systems.

# Review sudoers file: sudo cat /etc/sudoers
# Remove unnecessary admin privileges

Isolate VirtualBox hosts

all

Run VirtualBox on dedicated systems separate from critical infrastructure.

🧯 If You Can't Patch

  • Restrict VirtualBox usage to non-critical systems only
  • Implement strict access controls and monitor for unusual local privilege escalation

🔍 How to Verify

Check if Vulnerable:

Check VirtualBox version: VBoxManage --version. If version is below 6.1.24 and OS is Solaris x86 or Linux, system is vulnerable.

Check Version:

VBoxManage --version

Verify Fix Applied:

Verify version is 6.1.24 or higher: VBoxManage --version

📡 Detection & Monitoring

Log Indicators:

  • VirtualBox crash logs
  • Unexpected VirtualBox service restarts
  • Unauthorized local privilege escalation attempts

Network Indicators:

  • None - local attack only

SIEM Query:

source="virtualbox" AND (event_type="crash" OR event_type="service_stop")

📊 Metadata

CVE ID: CVE-2021-2443
CVSS v3 Score: 7.3 (HIGH)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
Published: July 21, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON