[ASA-202101-37] virtualbox: multiple issues

[Morten Linderud]

Arch Linux Security Advisory ASA-202101-37
==========================================

Severity: High
Date    : 2021-01-20
CVE-ID  : CVE-2021-2073 CVE-2021-2074 CVE-2021-2086 CVE-2021-2111
          CVE-2021-2112 CVE-2021-2119 CVE-2021-2120 CVE-2021-2121
          CVE-2021-2123 CVE-2021-2124 CVE-2021-2125 CVE-2021-2126
          CVE-2021-2127 CVE-2021-2128 CVE-2021-2129 CVE-2021-2130
          CVE-2021-2131
Package : virtualbox
Type    : multiple issues
Remote  : No
Link    : https://security.archlinux.org/AVG-1483

Summary
=======

The package virtualbox before version 6.1.18-1 is vulnerable to
multiple issues including arbitrary code execution, insufficient
validation, denial of service and information disclosure.

Resolution
==========

Upgrade to 6.1.18-1.

# pacman -Syu "virtualbox>=6.1.18-1"

The problems have been fixed upstream in version 6.1.18.

Workaround
==========

None.

Description
===========

- CVE-2021-2073 (denial of service)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful
attacks of this vulnerability can result in unauthorized ability to
cause a hang or frequently repeatable crash (complete DOS) of Oracle VM
VirtualBox.

- CVE-2021-2074 (arbitrary code execution)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in takeover of Oracle VM VirtualBox.

- CVE-2021-2086 (denial of service)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized ability to cause a hang or frequently
repeatable crash (complete DOS) of Oracle VM VirtualBox.

- CVE-2021-2111 (denial of service)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized ability to cause a hang or frequently
repeatable crash (complete DOS) of Oracle VM VirtualBox.

- CVE-2021-2112 (denial of service)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized ability to cause a hang or frequently
repeatable crash (complete DOS) of Oracle VM VirtualBox.

- CVE-2021-2119 (information disclosure)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized access to critical data or complete access
to all Oracle VM VirtualBox accessible data.

- CVE-2021-2120 (information disclosure)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized access to critical data or complete access
to all Oracle VM VirtualBox accessible data.

- CVE-2021-2121 (denial of service)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized ability to cause a hang or frequently
repeatable crash (complete DOS) of Oracle VM VirtualBox.

- CVE-2021-2123 (information disclosure)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized read access to a subset of Oracle VM
VirtualBox accessible data.

- CVE-2021-2124 (denial of service)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized ability to cause a hang or frequently
repeatable crash (complete DOS) of Oracle VM VirtualBox.

- CVE-2021-2125 (insufficient validation)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized update, insert or delete access to some of
Oracle VM VirtualBox accessible data as well as unauthorized read
access to a subset of Oracle VM VirtualBox accessible data.

- CVE-2021-2126 (insufficient validation)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized creation, deletion or modification access to
critical data or all Oracle VM VirtualBox accessible data.

- CVE-2021-2127 (denial of service)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful
attacks of this vulnerability can result in unauthorized ability to
cause a hang or frequently repeatable crash (complete DOS) of Oracle VM
VirtualBox.

- CVE-2021-2128 (information disclosure)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
low privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized access to critical data or complete access
to all Oracle VM VirtualBox accessible data.

- CVE-2021-2129 (insufficient validation)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized creation, deletion or modification access to
critical data or all Oracle VM VirtualBox accessible data as well as
unauthorized access to critical data or complete access to all Oracle
VM VirtualBox accessible data.

- CVE-2021-2130 (denial of service)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful
attacks of this vulnerability can result in unauthorized ability to
cause a hang or frequently repeatable crash (complete DOS) of Oracle VM
VirtualBox.

- CVE-2021-2131 (insufficient validation)

Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). The supported version that is
affected is Prior to 6.1.18. Easily exploitable vulnerability allows
high privileged attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. While the
vulnerability is in Oracle VM VirtualBox, attacks may significantly
impact additional products. Successful attacks of this vulnerability
can result in unauthorized creation, deletion or modification access to
critical data or all Oracle VM VirtualBox accessible data.

Impact
======

Some exploit might crash the application or bypass authorization for
resource modification.

References
==========

https://www.oracle.com/security-alerts/cpujan2021verbose.html#OVIR
https://security.archlinux.org/CVE-2021-2073
https://security.archlinux.org/CVE-2021-2074
https://security.archlinux.org/CVE-2021-2086
https://security.archlinux.org/CVE-2021-2111
https://security.archlinux.org/CVE-2021-2112
https://security.archlinux.org/CVE-2021-2119
https://security.archlinux.org/CVE-2021-2120
https://security.archlinux.org/CVE-2021-2121
https://security.archlinux.org/CVE-2021-2123
https://security.archlinux.org/CVE-2021-2124
https://security.archlinux.org/CVE-2021-2125
https://security.archlinux.org/CVE-2021-2126
https://security.archlinux.org/CVE-2021-2127
https://security.archlinux.org/CVE-2021-2128
https://security.archlinux.org/CVE-2021-2129
https://security.archlinux.org/CVE-2021-2130
https://security.archlinux.org/CVE-2021-2131
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210128/d28515cb/attachment.sig>