CVE-2023-21987
Published: 18 April 2023
Summary
CVE-2023-21987 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Oracle Vm Virtualbox. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 6.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-21987 is a vulnerability in the Core component of Oracle VM VirtualBox within Oracle Virtualization. It affects versions prior to 6.1.44 and prior to 7.0.8. The flaw carries a CVSS 3.1 base score of 7.8 with the vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a difficult-to-exploit issue that can produce full confidentiality, integrity, and availability impacts along with a scope change to other products.
A low-privileged attacker who already has local logon access to the host running VirtualBox can leverage the vulnerability to compromise the hypervisor and achieve a full takeover of the VirtualBox process. Because the attack occurs from an authenticated local context and crosses scope boundaries, successful exploitation can affect additional components beyond the VirtualBox instance itself.
The referenced Oracle April 2023 Critical Patch Update at https://www.oracle.com/security-alerts/cpuapr2023.html addresses the issue by providing updated VirtualBox releases that remediate the flaw for supported versions.
EPSS remains flat at a peak and current value of 0.0972 with no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-26152
Vulnerability details
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle…
more
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.
Access supervision ensures privileges are assigned and managed without improper escalation or retention.
Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.
Enforces proper privilege management by requiring all decisions through the verified reference monitor.
By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.
Implements core proper privilege management by restricting to only required rights.
Policy requires training on privilege management and least privilege, making it harder to exploit improper privilege management weaknesses.
Training covers proper privilege management practices, making incorrect privilege assignments less likely.