Arch Linux Security Advisory ASA-202110-3
========================================
Severity: High
Date    : 2021-10-21
CVE-ID  : CVE-2021-2475  CVE-2021-35538 CVE-2021-35540 CVE-2021-35542
          CVE-2021-35545
Package : virtualbox
Type    : multiple issues
Remote  : No
Link    : https://security.archlinux.org/AVG-2476

Summary
======
The package virtualbox before version 6.1.28-1 is vulnerable to
multiple issues including sandbox escape, denial of service and
information disclosure.

Resolution
=========
Upgrade to 6.1.28-1.

# pacman -Syu "virtualbox>=6.1.28-1"

The problems have been fixed upstream in version 6.1.28.

Workaround
=========
None.

Description
==========
- CVE-2021-2475 (denial of service)

A security issue has been found in Oracle VM VirtualBox before version
6.1.28. An easily exploitable vulnerability allows high privileged
attacker with logon to the infrastructure where Oracle VM VirtualBox
executes to compromise Oracle VM VirtualBox. Successful attacks of this
vulnerability can result in the unauthorized ability to cause a hang or
frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.

- CVE-2021-35538 (sandbox escape)

A security issue has been found in Oracle VM VirtualBox before version
6.1.28. An easily exploitable vulnerability allows low privileged
attacker with logon to the infrastructure where Oracle VM VirtualBox
executes to compromise Oracle VM VirtualBox. Successful attacks of this
vulnerability can result in takeover of Oracle VM VirtualBox.

- CVE-2021-35540 (denial of service)

A security issue has been found in Oracle VM VirtualBox before version
6.1.28. An easily exploitable vulnerability allows low privileged
attacker with logon to the infrastructure where Oracle VM VirtualBox
executes to compromise Oracle VM VirtualBox. Successful attacks of this
vulnerability can result in the unauthorized ability to cause a hang or
frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.

- CVE-2021-35542 (denial of service)

A security issue has been found in Oracle VM VirtualBox before version
6.1.28. An easily exploitable vulnerability allows high privileged
attacker with logon to the infrastructure where Oracle VM VirtualBox
executes to compromise Oracle VM VirtualBox. Successful attacks of this
vulnerability can result in the unauthorized ability to cause a hang or
frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.

- CVE-2021-35545 (information disclosure)

A security issue has been found in Oracle VM VirtualBox before version
6.1.28. An easily exploitable vulnerability allows high privileged
attacker with logon to the infrastructure where Oracle VM VirtualBox
executes to compromise Oracle VM VirtualBox. While the vulnerability is
in Oracle VM VirtualBox, attacks may significantly impact additional
products. Successful attacks of this vulnerability can result in
unauthorized ability to cause a hang or frequently repeatable crash
(complete DOS) of Oracle VM VirtualBox and unauthorized read access to
a subset of Oracle VM VirtualBox accessible data.

Impact
=====
A malicious virtual machine guest could escape its confinement to run
arbitrary code on the host system, disclose sensitive information, or
crash VirtualBox.

References
=========
https://www.oracle.com/security-alerts/cpuoct2021verbose.html#OVIR
https://security.archlinux.org/CVE-2021-2475
https://security.archlinux.org/CVE-2021-35538
https://security.archlinux.org/CVE-2021-35540
https://security.archlinux.org/CVE-2021-35542
https://security.archlinux.org/CVE-2021-35545