KLA11179 Multiple vulnerabilities in Oracle VM VirtualBox

Multiple serious vulnerabilities have been found in Oracle VM VirtualBox. Malicious users can exploit these vulnerabilities to obtain sensitive information and gain privileges.

Below is a complete list of vulnerabilities:

1. Multiple unspecified vulnerabilities in Core subcomponent of Oracle Virtualization can be exploited locally to gain privileges and possibly to obtain sensitive information;
2. An unspecified vulnerability in Guest Additions subcomponent of Oracle Virtualization can be exploited locally to gain privileges and possibly to obtain sensitive information;
3. Vulnerability in OpenSSL component of Oracle VM VirtualBox can be exploited remotely via using a carry propagation flaw in the x86_64 Montgomery squaring function to obtain sensitive information about the SSL private keys.

Technical details

Vulnerability (3) affects only OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g on the processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.

Original advisories

Oracle Critical Patch Update Advisory – January 2018

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Oracle-VirtualBox

CVE list

CVE-2017-5715 high

CVE-2018-2676 critical

CVE-2017-3736 high

CVE-2018-2685 critical

CVE-2018-2686 critical

CVE-2018-2687 critical

CVE-2018-2688 critical

CVE-2018-2689 critical

CVE-2018-2690 critical

CVE-2018-2693 critical

CVE-2018-2694 critical

CVE-2018-2698 critical

Solution

Update to the latest version

Oracle software downloads

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Oracle VM VirtualBox 5.1.x earlier than 5.1.32Oracle VM VirtualBox 5.2.x earlier than 5.2.6