VirtualBox Vulnerability Warning

Well that's awkward Oracle VirtualBox Elevation of Privilege Vulnerability (CVE-2024-21111): PoC Published BY QRION APRIL 22, 2024 Security researcher Naor Hodorov has made public a proof-of-concept (PoC) exploit for a severe vulnerability (CVE-2024-21111) in Oracle VirtualBox. This vulnerability plagues VirtualBox versions before 7.0.16 and allows attackers with basic access to a Windows system running VirtualBox to escalate their privileges. Download VirtualBox Here you will find links to VirtualBox binaries and its source code. VirtualBox binaries By downloading, you agree to the terms and conditions of the respective license. ATTENTION: PLEASE REFRAIN FROM UPGRADING TO 7.0.16 FOR NOW. THIS RELEASE HAS AN ISSUE WHICH MIGHT CAUSE HOST OS CRASH WHEN VM IS CONFIGURED TO USE BRIDGED OR HOST-ONLY NETWORKING. WE WILL SEND AN ANNOUNCEMENT TO MAILING LISTS WHEN FIX WILL BE AVAILABLE FOR DOWNLOAD. VirtualBox 7.0.16 platform packages Windows hosts macOS / Intel hosts Linux distributions Solaris hosts Solaris 11 IPS hosts

A social media post says “Well that's awkward” above a screenshot of an Oracle VirtualBox security advisory. The joke is that the newly published privilege-escalation exploit affects older VirtualBox versions, while the download page simultaneously warns users not to upgrade to version 7.0.16 because it may crash the host operating system. It is shared as a reaction to an absurdly unfortunate security and release-management situation.

• @gentoomemes / 10849 2024-04-23