Yuhao Jiang

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox version 7.2.8 **Description** An issue exists in the VMSVGA device component of Oracle VM VirtualBox. A high-privileged attacker with logon access to the infrastructure where the software executes can compromise the system. This may lead to a scope change, significantly impacting additional products and resulting in unauthorized access to critical data or complete access to all accessible data within Oracle VM VirtualBox. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox version 7.2.8 **Description** An issue exists in the VMSVGA device component of Oracle VM VirtualBox. A high-privileged attacker with logon access to the infrastructure where the software executes can compromise the system. This may result in unauthorized read access to a subset of accessible data and can significantly impact additional products due to a scope change. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox version 7.2.8 **Description** An issue exists in the VMSVGA device component of Oracle VM VirtualBox. A high-privileged attacker with logon access to the infrastructure where the software executes can compromise the system. This may result in unauthorized read access to a subset of accessible data and can significantly impact additional products due to a scope change. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox version 7.2.8 **Description** An issue exists in the VMSVGA device component of Oracle VM VirtualBox. A high privileged attacker with logon access to the infrastructure where the software executes can compromise the system. This may result in unauthorized creation, deletion, or modification of critical data or all data accessible to Oracle VM VirtualBox. The attack can also significantly impact additional products due to a scope change. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox version 7.2.8 **Description** An issue exists in the VMSVGA device component of Oracle VM VirtualBox. A high-privileged attacker with access to the infrastructure where the software executes can compromise the system. This may lead to a scope change, significantly impacting additional products. Successful exploitation can result in a complete Denial of Service (DOS), characterized by a system hang or frequently repeatable crashes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions 7.1.14 and 7.2.4 **Description** An easily exploitable issue exists in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). A high-privileged attacker with access to the system where Oracle VM VirtualBox runs can compromise the software. Successful exploitation may lead to unauthorized read access to some Oracle VM VirtualBox data and a partial denial of service. Attacks may impact additional products. **Recommendations** Update Oracle VM VirtualBox to a version later than 7.1.14. Update Oracle VM VirtualBox to a version later than 7.2.4.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 7.0.24 Oracle VM VirtualBox versions prior to 7.1.6 **Description** The issue allows a high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle VM VirtualBox accessible data, as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service of Oracle VM VirtualBox. The vulnerability is related to the Core component of Oracle VM VirtualBox and may significantly impact additional products. **Recommendations** For Oracle VM VirtualBox versions prior to 7.0.24, update to version 7.0.24 or later. For Oracle VM VirtualBox versions prior to 7.1.6, update to version 7.1.6 or later. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** VMware ESXi, Workstation, and Fusion (affected versions not specified) **Description** A heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI) allows a malicious actor with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox, whereas on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed. The vulnerability was demonstrated at the GeekPwn 2022 hacking contest and has been used to escape the virtual machine. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.