Oracle has released a corrective update for the VirtualBox 6.1.20 virtualization system, which includes 22 fixes. The change log does not explicitly state the resolution of 20 vulnerabilities, which Oracle reported separately but without detailed information. It is known that three of the most critical issues have danger levels of 8.1, 8.2, and 8.4 (likely allowing access to the host system from the virtual machine), and one of the issues permits a remote attack through manipulation of the RDP protocol.
Key Changes:
- Support for Linux kernels 5.11 and 5.12 has been added for guest systems and hosts running Linux.
- In the guest additions for systems using Linux kernels 4.10 and up, the maximum MTU size for Host-Only mode network adapters has been increased to 16110.
- The guest additions have fixed the issue with building the vboxvideo module for Linux kernels 5.10.x.
- Support for building kernel modules in RHEL 8.4-beta and CentOS Stream distributions has been added in the guest additions.
- In VBoxManage, the 'modifyvm' command is now permitted for changing the network adapter attachment to a saved virtual machine.
- In the manager of virtual machines (VMM) has resolved a performance issue, addressed problems with the handling of guest systems when Hyper-V is present, and fixed a bug related to nested virtualization.
- A crash related to the use of SMAP (Supervisor Mode Access Prevention) has been resolved for host systems, which manifested in Solaris 11.4 on systems with Intel Haswell processors and newer.
- Integration components with OCI (Oracle Cloud Infrastructure) have added support for using cloud-init for exporting to OCI and for creating environment instances in OCI.
- In the GUI, the issue with leaving the log Logs/VBoxUI.log when executing the 'Delete all files' operation has been resolved.
- Sound support has been improved.
- Network link status notifications have been established for adapters in the 'not attached' state.
- Network connection issues when using the e1000 virtual network adapter in guest systems with OS/2 have been resolved.
- Compatibility of the e1000 driver with VxWorks has been improved.
- In the GUI, issues with port forwarding rules validation (rules with IPv6 were not accepted) have been resolved.
- DHCP crashes due to fixed address settings have been eliminated.
- Fixed the virtual machine hang when using the serial port in detached mode.
- Improved driver compatibility for webcams with v4l2loopback.
- Resolved random hangs or reboots of Windows virtual machines using the NVMe virtual driver.
- Added support for the ‘—root’ option in vboximg-mount.
Source: opennet.ru
