Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

VirtualBox priv esc #666

Merged
merged 2 commits into from
Apr 23, 2024
Merged

VirtualBox priv esc #666

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3c2554f
VirtualBox priv esc
ryan-aus Apr 23, 2024
e21302c
Format markdown docs
ryan-aus Apr 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions docs/advisories/20240423001-VirtualBox-EoP-vuln-PoC.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
# VirtualBox Privelege Escalation Vulnerability - 20240423001

## Overview

An easily exploitable vulnerability in Oracle VM VirtualBox allows a low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox and the Windows system running it.

## What is vulnerable?

| CVE | Severity | CVSS | Product(s) Affected | Summary | Dated |
| ----------------------------------------------------------------- | -------- | ---- | --------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ---------- |
| [CVE-2024-21111](https://nvd.nist.gov/vuln/detail/CVE-2024-21111) | **High** | 7.8 | Oracle VM VirtualBox prior to 7.0.16 - Windows only | Allows attackers with basic access to a Windows system running VirtualBox to escalate their privileges. | 16/04/2024 |

## What has been observed?

There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.

## Recommendation

The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of one month (refer [Patch Management](../guidelines/patch-management.md)):

- [Oracle Critical Patch Update Advisory - April 2024](https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixOVIR)

## Additional References

- [Oracle VirtualBox Elevation of Privilege Vulnerability (CVE-2024-21111): PoC Published](https://securityonline.info/oracle-virtualbox-elevation-of-privilege-vulnerability-cve-2024-21111-poc-published/)