Every CVE Search/ Get API key

CVE-2021-25319

virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group

7.8 High

A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.26%Unchanged since May 5, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.8

virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group

A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.

Record
CVE-2021-25319
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-276
Updated
2026-11-02
EUVDEUVD-2021-12216 7.8

A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.

Record
EUVD-2021-12216
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-x9mv-6frm-qg9c No score

A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory...

A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.

Record
GHSA-x9mv-6frm-qg9c
Weakness
CWE-276
Updated
2026-11-02
NVD 7.8

A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.

Record
CVE-2021-25319
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-276
Updated
2026-11-02
OSVUBUNTU-CVE-2021-25319 7.8

A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.

Record
UBUNTU-CVE-2021-25319
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2021:0723-1 No score

Security update for virtualbox

This update for virtualbox fixes the following issues:

virtualbox was updated to 6.1.22 (released April 29 2021 by Oracle)

This is a maintenance release. The following items were fixed and/or added:

  • VMM: Improved performance of 64-bit Windows and Solaris guests when Hyper-V is used on recent Windows 10 hosts

  • VMM: Fixed frequent crashes of 64-bit Windows Vista and Server 2003 guests when Hyper-V is used

  • GUI: Fixed regression where user was not able to save unset default shortcuts (bug #20305)

  • Storage: Fixed regression in LsiLogic SAS controller emulation caused VM crash (bug #20323)

  • Linux Guest Additions: Fixed issue when it was not possible to run executables from mounted share (bug #20320)

  • Fixes for CVE-2021-2145 CVE-2021-2250 CVE-2021-2264 CVE-2021-2266 CVE-2021-2279 CVE-2021-2280 CVE-2021-2281 CVE-2021-2282 CVE-2021-2283 CVE-2021-2284 CVE-2021-2285 CVE-2021-2286 CVE-2021-2287 CVE-2021-2291 CVE-2021-2296 CVE-2021-2297 CVE-2021-2306 CVE-2021-2309 CVE-2021-2310 CVE-2021-2312

  • Version bump to (released April 20 2021 by Oracle) File 'virtualbox-kmp-files-leap' is deleted.

  • Use distconfdir for xinitrc.d files on TW

  • Improve autostart security boo#1182918.

Record
openSUSE-SU-2021:0723-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0977-1 No score

Security update for virtualbox

This update for virtualbox fixes the following issues:

  • Update vboxdrv.sh per boo#1186361

Version bump to 6.1.22 (released April 29 2021 by Oracle)

  • This is a maintenance release. The following items were fixed and/or added:

  • VMM: Improved performance of 64-bit Windows and Solaris guests when Hyper-V is used on recent Windows 10 hosts

  • VMM: Fixed frequent crashes of 64-bit Windows Vista and Server 2003 guests when Hyper-V is used

  • GUI: Fixed regression where user was not able to save unset default shortcuts (bug #20305)

  • Storage: Fixed regression in LsiLogic SAS controller emulation caused VM crash (bug #20323)

  • Linux Guest Additions: Fixed issue when it was not possible to run executables from mounted share (bug #20320)

  • Fixes for CVE-2021-2145 CVE-2021-2250 CVE-2021-2264 CVE-2021-2266 CVE-2021-2279 CVE-2021-2280 CVE-2021-2281 CVE-2021-2282 CVE-2021-2283 CVE-2021-2284 CVE-2021-2285 CVE-2021-2286 CVE-2021-2287 CVE-2021-2291 CVE-2021-2296 CVE-2021-2297 CVE-2021-2306 CVE-2021-2309 CVE-2021-2310 CVE-2021-2312

  • Improve autostart security boo#1182918.

Record
openSUSE-SU-2021:0977-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
virtualbox
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.0.4-dfsg-25.0.8-dfsg-15.0.10-dfsg-15.0.10-dfsg-25.0.10-dfsg-3
Show 25 moreShow less
5.0.10-dfsg-45.0.10-dfsg-55.0.10-dfsg-65.0.10-dfsg-75.0.12-dfsg-15.0.12-dfsg-25.0.14-dfsg-15.0.14-dfsg-25.0.14-dfsg-2build15.0.16-dfsg-25.0.16-dfsg-35.0.18-dfsg-15.0.18-dfsg-1ubuntu15.0.18-dfsg-25.0.18-dfsg-2build15.0.18-dfsg-2ubuntu15.0.24-dfsg-0ubuntu1.16.04.15.0.32-dfsg-0ubuntu1.16.04.25.0.36-dfsg-0ubuntu1.16.04.25.0.40-dfsg-0ubuntu1.16.04.15.0.40-dfsg-0ubuntu1.16.04.25.1.34-dfsg-0ubuntu1.16.04.25.1.38-dfsg-0ubuntu1.16.04.15.1.38-dfsg-0ubuntu1.16.04.25.1.38-dfsg-0ubuntu1.16.04.3
 None known
virtualbox
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.1.30-dfsg-15.2.0-dfsg-1build25.2.0-dfsg-25.2.0-dfsg-45.2.0-dfsg-5
Show 26 moreShow less
5.2.2-dfsg-25.2.2-dfsg-3~build15.2.2-dfsg-35.2.4-dfsg-15.2.4-dfsg-25.2.6-dfsg-15.2.6-dfsg-25.2.6-dfsg-35.2.6-dfsg-3build15.2.6-dfsg-55.2.8-dfsg-25.2.8-dfsg-35.2.8-dfsg-55.2.8-dfsg-65.2.8-dfsg-75.2.10-dfsg-15.2.10-dfsg-25.2.10-dfsg-55.2.10-dfsg-65.2.10-dfsg-6ubuntu18.04.15.2.18-dfsg-2~ubuntu18.04.15.2.18-dfsg-2~ubuntu18.04.35.2.18-dfsg-2~ubuntu18.04.55.2.32-dfsg-0~ubuntu18.04.15.2.34-dfsg-0~ubuntu18.04.15.2.42-dfsg-0~ubuntu1.18.04.1
 None known
virtualbox
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.0.14-dfsg-16.0.14-dfsg-2~build16.0.14-dfsg-26.1.0-dfsg-3build16.1.0-dfsg-3build2
Show 18 moreShow less
6.1.2-dfsg-16.1.2-dfsg-1build16.1.4-dfsg-16.1.4-dfsg-2~build16.1.4-dfsg-26.1.4-dfsg-46.1.6-dfsg-16.1.10-dfsg-1~ubuntu1.20.04.16.1.16-dfsg-6~ubuntu1.20.04.16.1.16-dfsg-6~ubuntu1.20.04.26.1.22-dfsg-2~ubuntu1.20.04.16.1.26-dfsg-3~ubuntu1.20.04.16.1.26-dfsg-3~ubuntu1.20.04.26.1.32-dfsg-1~ubuntu1.20.04.16.1.34-dfsg-3~ubuntu1.20.04.16.1.38-dfsg-3~ubuntu1.20.04.16.1.48-dfsg-1~ubuntu1.20.04.16.1.50-dfsg-1~ubuntu1.20.04.1
 None known
virtualbox
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.1.26-dfsg-46.1.28-dfsg-16.1.30-dfsg-16.1.32-dfsg-16.1.32-dfsg-1build1
Show 5 moreShow less
6.1.34-dfsg-3~ubuntu1.22.04.16.1.38-dfsg-3~ubuntu1.22.04.16.1.48-dfsg-1~ubuntu1.22.04.16.1.50-dfsg-1~ubuntu1.22.04.16.1.50-dfsg-1~ubuntu1.22.04.3
 None known
virtualbox
Ubuntu:24.04:LTS
 All versions, plus listed versions
7.0.10-dfsg-37.0.12-dfsg-17.0.12-dfsg-1build17.0.14-dfsg-17.0.14-dfsg-2
Show 8 moreShow less
7.0.14-dfsg-47.0.14-dfsg-4build47.0.14-dfsg-4build57.0.16-dfsg-17.0.16-dfsg-27.0.16-dfsg-2ubuntu17.0.16-dfsg-2ubuntu1.17.0.16-dfsg-2ubuntu1.3
 None known
virtualbox
Ubuntu:25.10
 All versions, plus listed versions
7.0.20-dfsg-1.27.0.26-dfsg-17.1.8-dfsg-27.1.8-dfsg-37.1.8-dfsg-3build1
Show 7 moreShow less
7.1.10-dfsg-17.1.12-dfsg-17.1.12-dfsg-27.2.0-dfsg-27.2.0-dfsg-37.2.2-dfsg-27.2.2-dfsg-2ubuntu0.1
 None known
virtualbox
Ubuntu:26.10
 All versions, plus listed versions
7.2.6-dfsg-47.2.8-dfsg-17.2.14-dfsg-37.2.16-dfsg-17.2.18-dfsg-17.2.20-dfsg-17.2.20-dfsg-2
 None known
virtualbox
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.2.2-dfsg-27.2.2-dfsg-37.2.4-dfsg-17.2.4-dfsg-1build17.2.4-dfsg-2~build1
Show 5 moreShow less
7.2.4-dfsg-37.2.6-dfsg-37.2.6-dfsg-3ubuntu17.2.6-dfsg-3.27.2.6-dfsg-4
 None known
virtualbox
openSUSE:Leap 15.2
From an advisory covering 21 CVEs
 before 6.1.22-lp152.2.24.2
6.1.22-lp152.2.24.2
virtualbox-kmp
openSUSE:Leap 15.2
From an advisory covering 21 CVEs
 before 6.1.22-lp152.2.24.2
6.1.22-lp152.2.24.2
virtualbox
openSUSE:Leap 15.3
From an advisory covering 21 CVEs
 before 6.1.22-lp153.2.3.2
6.1.22-lp153.2.3.2
virtualbox-kmp
openSUSE:Leap 15.3
From an advisory covering 21 CVEs
 before 6.1.22-lp153.2.3.2
6.1.22-lp153.2.3.2

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-25319 is a high vulnerability (CVSS 7.8) in Opensuse Factory, published May 5, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. No source names a fixed version.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open