What is the severity of CVE-2020-2575?

CVE-2020-2575 has a severity rating of 7.8 (high).

Which versions of Oracle VM VirtualBox are affected by CVE-2020-2575?

Versions prior to 5.2.40, prior to 6.0.20, and prior to 6.1.6 of Oracle VM VirtualBox are affected by CVE-2020-2575.

How can a high privileged attacker exploit CVE-2020-2575?

CVE-2020-2575 is difficult to exploit, but a high privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox is installed can exploit this vulnerability.

How can I mitigate CVE-2020-2575?

To mitigate CVE-2020-2575, it is recommended to update Oracle VM VirtualBox to version 5.2.40, 6.0.20, or 6.1.6, depending on the affected version.

Vulnerability/
CVE-2020-2575

high

7.8

CWE

908

29/4/2020

21/7/2021

21/10/2023

CVE-2020-2575: (Pwn2Own) Oracle VirtualBox OHCI Uninitialized Variable Privilege Escalation Vulnerability

Q: What is CVE-2020-2575?

CVE-2020-2575 is a vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization that allows for privilege escalation.

First published: Wed Apr 29 2020(Updated: )

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior to 6.0.20 and prior to 6.1.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

Credit: secalert_us@oracle.com

Affected Software	Affected Version	How to fix
Oracle VM VirtualBox	<5.2.40
Oracle VM VirtualBox	>=6.0.0<6.0.20
Oracle VM VirtualBox	>=6.1.0<6.1.6
Oracle VirtualBox

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2020-2575?
CVE-2020-2575 is a vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization that allows for privilege escalation.
What is the severity of CVE-2020-2575?
CVE-2020-2575 has a severity rating of 7.8 (high).
Which versions of Oracle VM VirtualBox are affected by CVE-2020-2575?
Versions prior to 5.2.40, prior to 6.0.20, and prior to 6.1.6 of Oracle VM VirtualBox are affected by CVE-2020-2575.
How can a high privileged attacker exploit CVE-2020-2575?
CVE-2020-2575 is difficult to exploit, but a high privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox is installed can exploit this vulnerability.
How can I mitigate CVE-2020-2575?
To mitigate CVE-2020-2575, it is recommended to update Oracle VM VirtualBox to version 5.2.40, 6.0.20, or 6.1.6, depending on the affected version.

collector/nvd-index
collector/zdi-advisory
alias/ZDI-20-582
alias/ZDI-CAN-10783
alias/CVE-2020-2575
vendor/oracle
canonical/oracle vm virtualbox
version/oracle vm virtualbox/6.0.0
version/oracle vm virtualbox/6.1.0
canonical/oracle virtualbox

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.