CVE-2024-21111
Published: 16 April 2024
Summary
CVE-2024-21111 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Oracle Vm Virtualbox. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-21111 is an easily exploitable vulnerability in the Core component of Oracle VM VirtualBox on Windows hosts, affecting all versions prior to 7.0.16. The flaw carries a CVSS 3.1 base score of 7.8 with high impact on confidentiality, integrity, and availability, and is associated with CWE-269 improper privilege management.
A low-privileged attacker who already has local logon access to the host system can leverage the issue to fully compromise and take over the VirtualBox process without user interaction. Because the attack occurs from the host side, successful exploitation grants the attacker control over the hypervisor instance and any guest virtual machines it manages.
The April 2024 Oracle Critical Patch Update advises upgrading VirtualBox to version 7.0.16 or later to address the flaw. A public exploit for the issue has been posted to Exploit-DB, and the EPSS score currently stands at 0.1112 with no material change from its recorded peak.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18825
Vulnerability details
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise…
more
Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows hosts only. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.
Access supervision ensures privileges are assigned and managed without improper escalation or retention.
Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.
Enforces proper privilege management by requiring all decisions through the verified reference monitor.
By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.
Implements core proper privilege management by restricting to only required rights.
Policy requires training on privilege management and least privilege, making it harder to exploit improper privilege management weaknesses.
Training covers proper privilege management practices, making incorrect privilege assignments less likely.