CVE-2020-14628: Oracle VirtualBox Guest Additions Unnecessary Privileges Local Privilege Escalation Vulnerability
First published: Wed Jul 15 2020(Updated: )
This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Guest Additions toolset. The issue results from the use of unnecessary privileges when performing service operations. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle VM VirtualBox | ||
| Oracle VirtualBox | <5.2.44 | |
| Oracle VirtualBox | >=6.0.0<6.0.24 | |
| Oracle VirtualBox | >=6.1.0<6.1.12 | |
| SUSE Linux | =15.1 | |
| SUSE Linux | =15.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html
- https://security.gentoo.org/glsa/202101-09
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.zerodayinitiative.com/advisories/ZDI-20-886/
Frequently Asked Questions
What is the severity of CVE-2020-14628?
CVE-2020-14628 has a high severity level due to its potential for privilege escalation on vulnerable Oracle VirtualBox installations.
How do I fix CVE-2020-14628?
To fix CVE-2020-14628, update your Oracle VirtualBox to the latest version to mitigate the vulnerability.
What systems are affected by CVE-2020-14628?
CVE-2020-14628 affects Oracle VirtualBox versions up to 5.2.44 and certain versions between 6.0.0 and 6.0.24, as well as 6.1.0 to 6.1.12.
Can CVE-2020-14628 be exploited remotely?
No, CVE-2020-14628 requires local access to the system to exploit the privilege escalation vulnerability.
What are the potential impacts of CVE-2020-14628?
The potential impacts of CVE-2020-14628 include unauthorized system access and control, allowing attackers to execute sensitive operations.
- agent/type
- agent/title
- agent/references
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-20-886
- alias/ZDI-CAN-10762
- alias/CVE-2020-14628
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-index
- vendor/oracle
- canonical/oracle vm virtualbox
- canonical/oracle virtualbox
- version/oracle virtualbox/6.0.0
- version/oracle virtualbox/6.1.0
- vendor/opensuse
- canonical/suse linux
- version/suse linux/15.1
- version/suse linux/15.2