CVE-2021-2454
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The...
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.24. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.24. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Record
CVE-2021-2454- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2021-16913
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.24. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Record
EUVD-2021-16913- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xc6m-x3c4-7938
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The...
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.24. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Record
GHSA-xc6m-x3c4-7938- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.24. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Record
CVE-2021-2454- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-2454
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.24. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Record
UBUNTU-CVE-2021-2454- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0385 No score
Updated virtualbox packages fix security vulnerability
This update provides the upstream 6.1.24 maintenance release that fixes at least the following security vulnerabilities:
An easily exploitable vulnerability in the Oracle VM VirtualBox (component: Core) prior to 6.1.24 allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox (CVE-2021-2409).
An easily exploitable vulnerability in the Oracle VM VirtualBox (component: Core) prior to 6.1.24 allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox (CVE-2021-2442).
An easily exploitable vulnerability in the Oracle VM VirtualBox (component: Core) prior to 6.1.24 allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data (CVE-2021-2443).
An difficult to exploit vulnerability in the Oracle VM VirtualBox (component: Core) prior to 6.1.24 allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox (CVE-2021-2454).
For other upstream fixes in this update, see the referenced changelog.
- Record
MGASA-2021-0385- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1092-1 No score
Security update for virtualbox
This update for virtualbox fixes the following issues:
Version bump to 6.1.24 (released July 20 2021 by Oracle)
This is a maintenance release. The following items were fixed and/or added:
-
Storage: Fixed starting a VM if a device is attached to a VirtIO SCSI port higher than 30 (bug #20213)
-
Storage: Improvement to DVD medium change signaling
-
Serial: Fixed a the guest missing interrupts under certain circumstances (6.0 regression, bug #18668)
-
Audio: Multiple fixes and enhancements
-
Network: Fixed connectivity issue with virtio-net after resuming VM with disconnected link
-
Network: Fixed UDP GSO fragmentation issue with missing 8 bytes of payload at the end of the first fragment
-
API: Fixed VM configuration for recent Windows Server versions
-
Extension Pack: Fixed issues with USB webcam pass-through on Linux
-
Host and guest driver: Fix small memory leak (bug #20280)
-
Linux host and guest: Support kernel version 5.13 (bug #20456)
-
Linux host and guest: Introduce support for SUSE SLES/SLED 15 SP3 kernels (bug #20396)
-
Linux host: Installer will not attempt to build kernel modules if system already has them installed and modules versions match current version
-
Guest Additions: Fixed crash on using shared clipboard (bug #19165)
-
Linux Guest Additions: Introduce support for Ubuntu specific kernels (bug #20325)
-
Solaris guest: Increased default memory and disk sizes
-
EFI: Support network booting with the E1000 network controller emulation
-
EFI: Stability improvements (bug #20090)
-
This release fixes boo#1188535, VUL-0: CVE-2021-2454, boo#1188536, VUL-0: CVE-2021-2409, boo#1188537, VUL-0: CVE-2021-2442, and boo#1188538, VUL-0: CVE-2021-2443.
-
Add vboximg-mount to packaging. boo#1188045.
-
Fix CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT problem with kernel 5.13 as shown in boo#1188105.
-
Disable the build of kmp vboxvideo, at least temporarily.
-
Correct WantedBy entry in vboxadd-service
-
Require which for /usr/lib/virtualbox/vboxadd-service
-
fix license packaging, small cruft cleanup (avoid owning directories provided by filesystem rpm)
- Record
openSUSE-SU-2021:1092-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1114-1 No score
Security update for virtualbox
This update for virtualbox fixes the following issues:
Version bump to 6.1.26 (released July 28 2021 by Oracle)
This is a maintenance release. The following items were fixed and/or added:
- VMSVGA: fixed VM screen artifacts after restoring from saved state (bug #20067)
- Storage: Fixed audio endianness for certain CUE sheet CD/DVD images.
- VBoxHeadless: Running VM will save its state on host shutdown
- VBoxManage: Fix OS detection for Ubuntu 20.10 ISO with unattended install
- Linux Additions: Fixed mouse pointer offsetting issue for VMSVGA graphics adapter in multi-monitor VM setup (6.1.24 regression)
Version bump to 6.1.24 (released July 20 2021 by Oracle)
This is a maintenance release. The following items were fixed and/or added:
-
Storage: Fixed starting a VM if a device is attached to a VirtIO SCSI port higher than 30 (bug #20213)
-
Storage: Improvement to DVD medium change signaling
-
Serial: Fixed a the guest missing interrupts under certain circumstances (6.0 regression, bug #18668)
-
Audio: Multiple fixes and enhancements
-
Network: Fixed connectivity issue with virtio-net after resuming VM with disconnected link
-
Network: Fixed UDP GSO fragmentation issue with missing 8 bytes of payload at the end of the first fragment
-
API: Fixed VM configuration for recent Windows Server versions
-
Extension Pack: Fixed issues with USB webcam pass-through on Linux
-
Host and guest driver: Fix small memory leak (bug #20280)
-
Linux host and guest: Support kernel version 5.13 (bug #20456)
-
Linux host and guest: Introduce support for SUSE SLES/SLED 15 SP3 kernels (bug #20396)
-
Linux host: Installer will not attempt to build kernel modules if system already has them installed and modules versions match current version
-
Guest Additions: Fixed crash on using shared clipboard (bug #19165)
-
Linux Guest Additions: Introduce support for Ubuntu specific kernels (bug #20325)
-
Solaris guest: Increased default memory and disk sizes
-
EFI: Support network booting with the E1000 network controller emulation
-
EFI: Stability improvements (bug #20090)
-
This release fixes boo#1188535, VUL-0: CVE-2021-2454, boo#1188536, VUL-0: CVE-2021-2409, boo#1188537, VUL-0: CVE-2021-2442, and boo#1188538, VUL-0: CVE-2021-2443.
-
Add vboximg-mount to packaging. boo#1188045.
-
Fixed CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT problem with kernel 5.13 as shown in boo#1188105.
-
Disable the build of kmp vboxvideo, at least temporarily.
-
Correct WantedBy entry in vboxadd-service
-
Require which for /usr/lib/virtualbox/vboxadd-service
-
fix license packaging, small cruft cleanup (avoid owning directories provided by filesystem rpm)
- Record
openSUSE-SU-2021:1114-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
virtualboxMageia:8 From an advisory covering 4 CVEs |
before 6.1.24-1.mga8 | 6.1.24-1.mga8 |
kmod-virtualboxMageia:8 From an advisory covering 4 CVEs |
before 6.1.24-1.1.mga8 | 6.1.24-1.1.mga8 |
virtualboxUbuntu:16.04:LTS |
All versions, plus listed versions 5.0.4-dfsg-25.0.8-dfsg-15.0.10-dfsg-15.0.10-dfsg-25.0.10-dfsg-3 Show 25 moreShow less5.0.10-dfsg-45.0.10-dfsg-55.0.10-dfsg-65.0.10-dfsg-75.0.12-dfsg-15.0.12-dfsg-25.0.14-dfsg-15.0.14-dfsg-25.0.14-dfsg-2build15.0.16-dfsg-25.0.16-dfsg-35.0.18-dfsg-15.0.18-dfsg-1ubuntu15.0.18-dfsg-25.0.18-dfsg-2build15.0.18-dfsg-2ubuntu15.0.24-dfsg-0ubuntu1.16.04.15.0.32-dfsg-0ubuntu1.16.04.25.0.36-dfsg-0ubuntu1.16.04.25.0.40-dfsg-0ubuntu1.16.04.15.0.40-dfsg-0ubuntu1.16.04.25.1.34-dfsg-0ubuntu1.16.04.25.1.38-dfsg-0ubuntu1.16.04.15.1.38-dfsg-0ubuntu1.16.04.25.1.38-dfsg-0ubuntu1.16.04.3 |
None known |
virtualboxUbuntu:18.04:LTS |
All versions, plus listed versions 5.1.30-dfsg-15.2.0-dfsg-1build25.2.0-dfsg-25.2.0-dfsg-45.2.0-dfsg-5 Show 26 moreShow less5.2.2-dfsg-25.2.2-dfsg-3~build15.2.2-dfsg-35.2.4-dfsg-15.2.4-dfsg-25.2.6-dfsg-15.2.6-dfsg-25.2.6-dfsg-35.2.6-dfsg-3build15.2.6-dfsg-55.2.8-dfsg-25.2.8-dfsg-35.2.8-dfsg-55.2.8-dfsg-65.2.8-dfsg-75.2.10-dfsg-15.2.10-dfsg-25.2.10-dfsg-55.2.10-dfsg-65.2.10-dfsg-6ubuntu18.04.15.2.18-dfsg-2~ubuntu18.04.15.2.18-dfsg-2~ubuntu18.04.35.2.18-dfsg-2~ubuntu18.04.55.2.32-dfsg-0~ubuntu18.04.15.2.34-dfsg-0~ubuntu18.04.15.2.42-dfsg-0~ubuntu1.18.04.1 |
None known |
virtualboxUbuntu:20.04:LTS |
All versions, plus listed versions 6.0.14-dfsg-16.0.14-dfsg-2~build16.0.14-dfsg-26.1.0-dfsg-3build16.1.0-dfsg-3build2 Show 18 moreShow less6.1.2-dfsg-16.1.2-dfsg-1build16.1.4-dfsg-16.1.4-dfsg-2~build16.1.4-dfsg-26.1.4-dfsg-46.1.6-dfsg-16.1.10-dfsg-1~ubuntu1.20.04.16.1.16-dfsg-6~ubuntu1.20.04.16.1.16-dfsg-6~ubuntu1.20.04.26.1.22-dfsg-2~ubuntu1.20.04.16.1.26-dfsg-3~ubuntu1.20.04.16.1.26-dfsg-3~ubuntu1.20.04.26.1.32-dfsg-1~ubuntu1.20.04.16.1.34-dfsg-3~ubuntu1.20.04.16.1.38-dfsg-3~ubuntu1.20.04.16.1.48-dfsg-1~ubuntu1.20.04.16.1.50-dfsg-1~ubuntu1.20.04.1 |
None known |
virtualboxUbuntu:22.04:LTS |
All versions, plus listed versions 6.1.26-dfsg-46.1.28-dfsg-16.1.30-dfsg-16.1.32-dfsg-16.1.32-dfsg-1build1 Show 5 moreShow less6.1.34-dfsg-3~ubuntu1.22.04.16.1.38-dfsg-3~ubuntu1.22.04.16.1.48-dfsg-1~ubuntu1.22.04.16.1.50-dfsg-1~ubuntu1.22.04.16.1.50-dfsg-1~ubuntu1.22.04.3 |
None known |
virtualboxUbuntu:24.04:LTS |
All versions, plus listed versions 7.0.10-dfsg-37.0.12-dfsg-17.0.12-dfsg-1build17.0.14-dfsg-17.0.14-dfsg-2 Show 8 moreShow less7.0.14-dfsg-47.0.14-dfsg-4build47.0.14-dfsg-4build57.0.16-dfsg-17.0.16-dfsg-27.0.16-dfsg-2ubuntu17.0.16-dfsg-2ubuntu1.17.0.16-dfsg-2ubuntu1.3 |
None known |
virtualboxUbuntu:25.10 |
All versions, plus listed versions 7.0.20-dfsg-1.27.0.26-dfsg-17.1.8-dfsg-27.1.8-dfsg-37.1.8-dfsg-3build1 Show 7 moreShow less7.1.10-dfsg-17.1.12-dfsg-17.1.12-dfsg-27.2.0-dfsg-27.2.0-dfsg-37.2.2-dfsg-27.2.2-dfsg-2ubuntu0.1 |
None known |
virtualboxUbuntu:26.10 |
All versions, plus listed versions 7.2.6-dfsg-47.2.8-dfsg-17.2.14-dfsg-37.2.16-dfsg-17.2.18-dfsg-17.2.20-dfsg-17.2.20-dfsg-2 |
None known |
virtualboxUbuntu:26.04:LTS |
All versions, plus listed versions 7.2.2-dfsg-27.2.2-dfsg-37.2.4-dfsg-17.2.4-dfsg-1build17.2.4-dfsg-2~build1 Show 5 moreShow less7.2.4-dfsg-37.2.6-dfsg-37.2.6-dfsg-3ubuntu17.2.6-dfsg-3.27.2.6-dfsg-4 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
virtualboxopenSUSE:Leap 15.3 From an advisory covering 4 CVEs |
before 6.1.24-lp153.2.6.1 | 6.1.24-lp153.2.6.1 |
virtualbox-kmpopenSUSE:Leap 15.3 From an advisory covering 4 CVEs |
before 6.1.24-lp153.2.6.1 | 6.1.24-lp153.2.6.1 |
virtualboxopenSUSE:Leap 15.2 From an advisory covering 4 CVEs |
before 6.1.26-lp152.2.35.1 | 6.1.26-lp152.2.35.1 |
virtualbox-kmpopenSUSE:Leap 15.2 From an advisory covering 4 CVEs |
before 6.1.26-lp152.2.35.1 | 6.1.26-lp152.2.35.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-2454 is a high vulnerability (CVSS 7.0) in Oracle Vm Virtualbox, published July 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. No source names a fixed version.
References
oracle.com/security-alerts/cpujul2021.html
security.gentoo.org/glsa/202208-36
nvd.nist.gov/vuln/detail/CVE-2021-2454
github.com/advisories/GHSA-xc6m-x3c4-7938
advisories.mageia.org/MGASA-2021-0385.html
bugs.mageia.org/show_bug.cgi?id=29279
Show 15 moreShow less
virtualbox.org/wiki/Changelog-6.1
ubuntu.com/security/CVE-2021-2454
cve.org/CVERecord?id=CVE-2021-2454
lists.opensuse.org/archives/list/[email protected]/thread/UQOOU7OS5PW5QXPE2UITMUDKYSU7JH54
bugzilla.suse.com/1188045
suse.com/security/cve/CVE-2021-2409