CVE-2021-2145
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The...
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
- Record
CVE-2021-2145- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2021-16604
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
- Record
EUVD-2021-16604- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3hf-m7m3-6crp
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The...
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
- Record
GHSA-v3hf-m7m3-6crp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
- Record
CVE-2021-2145- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-2145
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
- Record
UBUNTU-CVE-2021-2145- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0197 No score
Updated virtualbox packages fix security vulnerabilities
This update provides the upstream 6.1.20 maintenance release that fixes at least the following security vulnerabilities:
A difficult to exploit vulnerability in the Oracle VM VirtualBox (component: Core) prior to 6.1.20 allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox (CVE-2021-2145, CVE-2021-2309, CVE-2021-2310).
An easily exploitable vulnerability in the Oracle VM VirtualBox (component: Core) prior to 6.1.20 allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox (CVE-2021-2250).
An easily exploitable vulnerability in the Oracle VM VirtualBox (component: Core) prior to 6.1.20 allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data (CVE-2021-2264).
An easily exploitable vulnerability in the Oracle VM VirtualBox (component: Core) prior to 6.1.20 allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data (CVE-2021-2266, CVE-2021-2306).
A difficult to exploit vulnerability in the Oracle VM VirtualBox (component: Core) prior to 6.1.20 allows unauthenticated attacker with network access via RDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox (CVE-2021-2279).
An easily exploitable vulnerability in the Oracle VM VirtualBox (component: Core) prior to 6.1.20 allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data (CVE-2021-2280, CVE-2021-2282, CVE-2021-2283, CVE-2021-2284, CVE-2021-2285, CVE-2021-2287).
An easily exploitable vulnerability in the Oracle VM VirtualBox (component: Core) prior to 6.1.20 allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. (CVE-2021-2281, CVE-2021-2284, CVE-2021-2286).
An easily exploitable vulnerability in the Oracle VM VirtualBox (component: Core) prior to 6.1.20 allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized access to critical data or…
- Record
MGASA-2021-0197- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0723-1 No score
Security update for virtualbox
This update for virtualbox fixes the following issues:
virtualbox was updated to 6.1.22 (released April 29 2021 by Oracle)
This is a maintenance release. The following items were fixed and/or added:
-
VMM: Improved performance of 64-bit Windows and Solaris guests when Hyper-V is used on recent Windows 10 hosts
-
VMM: Fixed frequent crashes of 64-bit Windows Vista and Server 2003 guests when Hyper-V is used
-
GUI: Fixed regression where user was not able to save unset default shortcuts (bug #20305)
-
Storage: Fixed regression in LsiLogic SAS controller emulation caused VM crash (bug #20323)
-
Linux Guest Additions: Fixed issue when it was not possible to run executables from mounted share (bug #20320)
-
Fixes for CVE-2021-2145 CVE-2021-2250 CVE-2021-2264 CVE-2021-2266 CVE-2021-2279 CVE-2021-2280 CVE-2021-2281 CVE-2021-2282 CVE-2021-2283 CVE-2021-2284 CVE-2021-2285 CVE-2021-2286 CVE-2021-2287 CVE-2021-2291 CVE-2021-2296 CVE-2021-2297 CVE-2021-2306 CVE-2021-2309 CVE-2021-2310 CVE-2021-2312
-
Version bump to (released April 20 2021 by Oracle) File 'virtualbox-kmp-files-leap' is deleted.
-
Use distconfdir for xinitrc.d files on TW
-
Improve autostart security boo#1182918.
- Record
openSUSE-SU-2021:0723-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0977-1 No score
Security update for virtualbox
This update for virtualbox fixes the following issues:
- Update vboxdrv.sh per boo#1186361
Version bump to 6.1.22 (released April 29 2021 by Oracle)
-
This is a maintenance release. The following items were fixed and/or added:
-
VMM: Improved performance of 64-bit Windows and Solaris guests when Hyper-V is used on recent Windows 10 hosts
-
VMM: Fixed frequent crashes of 64-bit Windows Vista and Server 2003 guests when Hyper-V is used
-
GUI: Fixed regression where user was not able to save unset default shortcuts (bug #20305)
-
Storage: Fixed regression in LsiLogic SAS controller emulation caused VM crash (bug #20323)
-
Linux Guest Additions: Fixed issue when it was not possible to run executables from mounted share (bug #20320)
-
Fixes for CVE-2021-2145 CVE-2021-2250 CVE-2021-2264 CVE-2021-2266 CVE-2021-2279 CVE-2021-2280 CVE-2021-2281 CVE-2021-2282 CVE-2021-2283 CVE-2021-2284 CVE-2021-2285 CVE-2021-2286 CVE-2021-2287 CVE-2021-2291 CVE-2021-2296 CVE-2021-2297 CVE-2021-2306 CVE-2021-2309 CVE-2021-2310 CVE-2021-2312
-
Improve autostart security boo#1182918.
- Record
openSUSE-SU-2021:0977-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11501-1 No score
python3-virtualbox-6.1.26-3.2 on GA media
These are all security issues fixed in the python3-virtualbox-6.1.26-3.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11501-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
virtualboxMageia:7 From an advisory covering 19 CVEs |
before 6.1.20-1.mga7 | 6.1.20-1.mga7 |
kmod-virtualboxMageia:7 From an advisory covering 19 CVEs |
before 6.1.20-1.mga7 | 6.1.20-1.mga7 |
virtualboxMageia:8 From an advisory covering 19 CVEs |
before 6.1.20-1.1.mga8 | 6.1.20-1.1.mga8 |
kmod-virtualboxMageia:8 From an advisory covering 19 CVEs |
before 6.1.20-1.1.mga8 | 6.1.20-1.1.mga8 |
virtualboxUbuntu:16.04:LTS |
All versions, plus listed versions 5.0.4-dfsg-25.0.8-dfsg-15.0.10-dfsg-15.0.10-dfsg-25.0.10-dfsg-3 Show 25 moreShow less5.0.10-dfsg-45.0.10-dfsg-55.0.10-dfsg-65.0.10-dfsg-75.0.12-dfsg-15.0.12-dfsg-25.0.14-dfsg-15.0.14-dfsg-25.0.14-dfsg-2build15.0.16-dfsg-25.0.16-dfsg-35.0.18-dfsg-15.0.18-dfsg-1ubuntu15.0.18-dfsg-25.0.18-dfsg-2build15.0.18-dfsg-2ubuntu15.0.24-dfsg-0ubuntu1.16.04.15.0.32-dfsg-0ubuntu1.16.04.25.0.36-dfsg-0ubuntu1.16.04.25.0.40-dfsg-0ubuntu1.16.04.15.0.40-dfsg-0ubuntu1.16.04.25.1.34-dfsg-0ubuntu1.16.04.25.1.38-dfsg-0ubuntu1.16.04.15.1.38-dfsg-0ubuntu1.16.04.25.1.38-dfsg-0ubuntu1.16.04.3 |
None known |
virtualboxUbuntu:18.04:LTS |
All versions, plus listed versions 5.1.30-dfsg-15.2.0-dfsg-1build25.2.0-dfsg-25.2.0-dfsg-45.2.0-dfsg-5 Show 26 moreShow less5.2.2-dfsg-25.2.2-dfsg-3~build15.2.2-dfsg-35.2.4-dfsg-15.2.4-dfsg-25.2.6-dfsg-15.2.6-dfsg-25.2.6-dfsg-35.2.6-dfsg-3build15.2.6-dfsg-55.2.8-dfsg-25.2.8-dfsg-35.2.8-dfsg-55.2.8-dfsg-65.2.8-dfsg-75.2.10-dfsg-15.2.10-dfsg-25.2.10-dfsg-55.2.10-dfsg-65.2.10-dfsg-6ubuntu18.04.15.2.18-dfsg-2~ubuntu18.04.15.2.18-dfsg-2~ubuntu18.04.35.2.18-dfsg-2~ubuntu18.04.55.2.32-dfsg-0~ubuntu18.04.15.2.34-dfsg-0~ubuntu18.04.15.2.42-dfsg-0~ubuntu1.18.04.1 |
None known |
virtualboxUbuntu:20.04:LTS |
All versions, plus listed versions 6.0.14-dfsg-16.0.14-dfsg-2~build16.0.14-dfsg-26.1.0-dfsg-3build16.1.0-dfsg-3build2 Show 18 moreShow less6.1.2-dfsg-16.1.2-dfsg-1build16.1.4-dfsg-16.1.4-dfsg-2~build16.1.4-dfsg-26.1.4-dfsg-46.1.6-dfsg-16.1.10-dfsg-1~ubuntu1.20.04.16.1.16-dfsg-6~ubuntu1.20.04.16.1.16-dfsg-6~ubuntu1.20.04.26.1.22-dfsg-2~ubuntu1.20.04.16.1.26-dfsg-3~ubuntu1.20.04.16.1.26-dfsg-3~ubuntu1.20.04.26.1.32-dfsg-1~ubuntu1.20.04.16.1.34-dfsg-3~ubuntu1.20.04.16.1.38-dfsg-3~ubuntu1.20.04.16.1.48-dfsg-1~ubuntu1.20.04.16.1.50-dfsg-1~ubuntu1.20.04.1 |
None known |
virtualboxUbuntu:22.04:LTS |
All versions, plus listed versions 6.1.26-dfsg-46.1.28-dfsg-16.1.30-dfsg-16.1.32-dfsg-16.1.32-dfsg-1build1 Show 5 moreShow less6.1.34-dfsg-3~ubuntu1.22.04.16.1.38-dfsg-3~ubuntu1.22.04.16.1.48-dfsg-1~ubuntu1.22.04.16.1.50-dfsg-1~ubuntu1.22.04.16.1.50-dfsg-1~ubuntu1.22.04.3 |
None known |
virtualboxopenSUSE:Leap 15.2 From an advisory covering 21 CVEs |
before 6.1.22-lp152.2.24.2 | 6.1.22-lp152.2.24.2 |
virtualbox-kmpopenSUSE:Leap 15.2 From an advisory covering 21 CVEs |
before 6.1.22-lp152.2.24.2 | 6.1.22-lp152.2.24.2 |
virtualboxopenSUSE:Leap 15.3 From an advisory covering 21 CVEs |
before 6.1.22-lp153.2.3.2 | 6.1.22-lp153.2.3.2 |
virtualbox-kmpopenSUSE:Leap 15.3 From an advisory covering 21 CVEs |
before 6.1.22-lp153.2.3.2 | 6.1.22-lp153.2.3.2 |
virtualboxopenSUSE:Tumbleweed From an advisory covering 43 CVEs |
before 6.1.26-3.2 | 6.1.26-3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-2145 is a high vulnerability (CVSS 7.5) in Oracle Vm Virtualbox, published April 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.81%, the 57th percentile. No source names a fixed version.
References
oracle.com/security-alerts/cpuapr2021.html
zerodayinitiative.com/advisories/ZDI-21-455
security.gentoo.org/glsa/202208-36
nvd.nist.gov/vuln/detail/CVE-2021-2145
github.com/advisories/GHSA-v3hf-m7m3-6crp
advisories.mageia.org/MGASA-2021-0197.html
Show 71 moreShow less
bugs.mageia.org/show_bug.cgi?id=28828
virtualbox.org/wiki/Changelog
ubuntu.com/security/CVE-2021-2145
cve.org/CVERecord?id=CVE-2021-2145
lists.opensuse.org/archives/list/[email protected]/thread/H2VYFQN75RCOBQFQCIU4LU7E32CGO4SK
bugzilla.suse.com/1182918
suse.com/security/cve/CVE-2021-2145
Left out here: the rest of 1 source description. The JSON record has them.