Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-21487: Oracle VirtualBox: Unauthorized Data Access in Previous Versions

CVE-2022-21487 · published 4 years ago

Summary

If you use Oracle VirtualBox version 6.1.34 or earlier, a malicious person with limited access to the system where VirtualBox is installed can access sensitive information stored within VirtualBox. This affects the confidentiality of your data. You should update to the latest version of VirtualBox to fix this issue.

What to do

Update oracle vm_virtualbox to version 6.1.34 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:16.04:LTS	canonical	virtualbox	All versions
Ubuntu:18.04:LTS	canonical	virtualbox	All versions
Ubuntu:20.04:LTS	canonical	virtualbox	All versions
Ubuntu:22.04:LTS	canonical	virtualbox	All versions
Ubuntu:24.04:LTS	canonical	virtualbox	All versions
Ubuntu:25.10	canonical	virtualbox	All versions
–	oracle	vm_virtualbox	< 6.1.34 `cpe:2.3:a:oracle:vm_virtualbox::::::::`

Original advisory text

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).

References

https://ubuntu.com/security/CVE-2022-21487 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-21487 Third Party Advisory
https://security.gentoo.org/glsa/202208-36 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.8 Low

Exploitation

<1% chance of attack within 30 days

Timeline

Published19 Apr 2022

Updated4 Nov 2026

First seen24 Mar 2026

Sources

UBUNTU-CVE-2022-21487 · OSV

CVE-2022-21487 · NVD

Track software like this

Free during beta