CVE-2021-2312

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The...

4.4 Medium

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: This vulnerability applies to Windows systems only. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.33%Down 0.1 points since Apr 27, 2021

What each source reports

CVE List Score used 4.4

Record: CVE-2021-2312
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

EUVDEUVD-2021-16771 4.4

Record: EUVD-2021-16771
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g3fx-qqcr-xfh6 4.4

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The...

Record: GHSA-g3fx-qqcr-xfh6
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

NVD 4.4

Record: CVE-2021-2312
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-2312 4.4

Record: UBUNTU-CVE-2021-2312
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2021:0723-1 No score

Security update for virtualbox

This update for virtualbox fixes the following issues:

virtualbox was updated to 6.1.22 (released April 29 2021 by Oracle)

This is a maintenance release. The following items were fixed and/or added:

VMM: Improved performance of 64-bit Windows and Solaris guests when Hyper-V is used on recent Windows 10 hosts
VMM: Fixed frequent crashes of 64-bit Windows Vista and Server 2003 guests when Hyper-V is used
GUI: Fixed regression where user was not able to save unset default shortcuts (bug #20305)
Storage: Fixed regression in LsiLogic SAS controller emulation caused VM crash (bug #20323)
Linux Guest Additions: Fixed issue when it was not possible to run executables from mounted share (bug #20320)
Fixes for CVE-2021-2145 CVE-2021-2250 CVE-2021-2264 CVE-2021-2266 CVE-2021-2279 CVE-2021-2280 CVE-2021-2281 CVE-2021-2282 CVE-2021-2283 CVE-2021-2284 CVE-2021-2285 CVE-2021-2286 CVE-2021-2287 CVE-2021-2291 CVE-2021-2296 CVE-2021-2297 CVE-2021-2306 CVE-2021-2309 CVE-2021-2310 CVE-2021-2312
Version bump to (released April 20 2021 by Oracle) File 'virtualbox-kmp-files-leap' is deleted.
Use distconfdir for xinitrc.d files on TW
Improve autostart security boo#1182918.

Record: openSUSE-SU-2021:0723-1
Updated: 2026-11-02

OSVopenSUSE-SU-2021:0977-1 No score

Security update for virtualbox

This update for virtualbox fixes the following issues:

Update vboxdrv.sh per boo#1186361

Version bump to 6.1.22 (released April 29 2021 by Oracle)

This is a maintenance release. The following items were fixed and/or added:
VMM: Improved performance of 64-bit Windows and Solaris guests when Hyper-V is used on recent Windows 10 hosts
VMM: Fixed frequent crashes of 64-bit Windows Vista and Server 2003 guests when Hyper-V is used
GUI: Fixed regression where user was not able to save unset default shortcuts (bug #20305)
Storage: Fixed regression in LsiLogic SAS controller emulation caused VM crash (bug #20323)
Linux Guest Additions: Fixed issue when it was not possible to run executables from mounted share (bug #20320)
Fixes for CVE-2021-2145 CVE-2021-2250 CVE-2021-2264 CVE-2021-2266 CVE-2021-2279 CVE-2021-2280 CVE-2021-2281 CVE-2021-2282 CVE-2021-2283 CVE-2021-2284 CVE-2021-2285 CVE-2021-2286 CVE-2021-2287 CVE-2021-2291 CVE-2021-2296 CVE-2021-2297 CVE-2021-2306 CVE-2021-2309 CVE-2021-2310 CVE-2021-2312
Improve autostart security boo#1182918.

Record: openSUSE-SU-2021:0977-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`virtualbox` Ubuntu:16.04:LTS	All versions, plus listed versions 5.0.4-dfsg-25.0.8-dfsg-15.0.10-dfsg-15.0.10-dfsg-25.0.10-dfsg-3 Show 25 moreShow less 5.0.10-dfsg-45.0.10-dfsg-55.0.10-dfsg-65.0.10-dfsg-75.0.12-dfsg-15.0.12-dfsg-25.0.14-dfsg-15.0.14-dfsg-25.0.14-dfsg-2build15.0.16-dfsg-25.0.16-dfsg-35.0.18-dfsg-15.0.18-dfsg-1ubuntu15.0.18-dfsg-25.0.18-dfsg-2build15.0.18-dfsg-2ubuntu15.0.24-dfsg-0ubuntu1.16.04.15.0.32-dfsg-0ubuntu1.16.04.25.0.36-dfsg-0ubuntu1.16.04.25.0.40-dfsg-0ubuntu1.16.04.15.0.40-dfsg-0ubuntu1.16.04.25.1.34-dfsg-0ubuntu1.16.04.25.1.38-dfsg-0ubuntu1.16.04.15.1.38-dfsg-0ubuntu1.16.04.25.1.38-dfsg-0ubuntu1.16.04.3	None known
`virtualbox` Ubuntu:18.04:LTS	All versions, plus listed versions 5.1.30-dfsg-15.2.0-dfsg-1build25.2.0-dfsg-25.2.0-dfsg-45.2.0-dfsg-5 Show 26 moreShow less 5.2.2-dfsg-25.2.2-dfsg-3~build15.2.2-dfsg-35.2.4-dfsg-15.2.4-dfsg-25.2.6-dfsg-15.2.6-dfsg-25.2.6-dfsg-35.2.6-dfsg-3build15.2.6-dfsg-55.2.8-dfsg-25.2.8-dfsg-35.2.8-dfsg-55.2.8-dfsg-65.2.8-dfsg-75.2.10-dfsg-15.2.10-dfsg-25.2.10-dfsg-55.2.10-dfsg-65.2.10-dfsg-6ubuntu18.04.15.2.18-dfsg-2~ubuntu18.04.15.2.18-dfsg-2~ubuntu18.04.35.2.18-dfsg-2~ubuntu18.04.55.2.32-dfsg-0~ubuntu18.04.15.2.34-dfsg-0~ubuntu18.04.15.2.42-dfsg-0~ubuntu1.18.04.1	None known
`virtualbox` Ubuntu:20.04:LTS	All versions, plus listed versions 6.0.14-dfsg-16.0.14-dfsg-2~build16.0.14-dfsg-26.1.0-dfsg-3build16.1.0-dfsg-3build2 Show 18 moreShow less 6.1.2-dfsg-16.1.2-dfsg-1build16.1.4-dfsg-16.1.4-dfsg-2~build16.1.4-dfsg-26.1.4-dfsg-46.1.6-dfsg-16.1.10-dfsg-1~ubuntu1.20.04.16.1.16-dfsg-6~ubuntu1.20.04.16.1.16-dfsg-6~ubuntu1.20.04.26.1.22-dfsg-2~ubuntu1.20.04.16.1.26-dfsg-3~ubuntu1.20.04.16.1.26-dfsg-3~ubuntu1.20.04.26.1.32-dfsg-1~ubuntu1.20.04.16.1.34-dfsg-3~ubuntu1.20.04.16.1.38-dfsg-3~ubuntu1.20.04.16.1.48-dfsg-1~ubuntu1.20.04.16.1.50-dfsg-1~ubuntu1.20.04.1	None known
`virtualbox` Ubuntu:22.04:LTS	All versions, plus listed versions 6.1.26-dfsg-46.1.28-dfsg-16.1.30-dfsg-16.1.32-dfsg-16.1.32-dfsg-1build1 Show 5 moreShow less 6.1.34-dfsg-3~ubuntu1.22.04.16.1.38-dfsg-3~ubuntu1.22.04.16.1.48-dfsg-1~ubuntu1.22.04.16.1.50-dfsg-1~ubuntu1.22.04.16.1.50-dfsg-1~ubuntu1.22.04.3	None known
`virtualbox` openSUSE:Leap 15.2 From an advisory covering 21 CVEs	before 6.1.22-lp152.2.24.2	6.1.22-lp152.2.24.2
`virtualbox-kmp` openSUSE:Leap 15.2 From an advisory covering 21 CVEs	before 6.1.22-lp152.2.24.2	6.1.22-lp152.2.24.2
`virtualbox` openSUSE:Leap 15.3 From an advisory covering 21 CVEs	before 6.1.22-lp153.2.3.2	6.1.22-lp153.2.3.2
`virtualbox-kmp` openSUSE:Leap 15.3 From an advisory covering 21 CVEs	before 6.1.22-lp153.2.3.2	6.1.22-lp153.2.3.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-2312 is a medium vulnerability (CVSS 4.4) in Oracle Vm Virtualbox, published April 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. No source names a fixed version.

References

Show 25 moreShow less