Security restrictions bypass in Oracle VM VirtualBox - CVE-2018-2845

Vulnerability identifier: #VU11902

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-2845

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to obtain potentially sensitive information, write arbitrary files and cause DoS condition on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper information control. A local attacker can partially access data, partially modify data and cause the service to crash.

Oracle VM VirtualBox
Gentoo Linux
Opensuse

Update to versions 5.1.36 or 5.2.10.

• http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

• Multiple vulnerabilities in Oracle VM VirtualBox
• OpenSUSE Linux update for virtualbox
• Gentoo update for VirtualBox