Oracle has published a corrective release of the VirtualBox virtualization system version 7.0.16, which includes 15 fixes. In addition to these changes, the new version addresses 13 vulnerabilities, 7 of which are marked as critical (four issues have a severity level of 8.8 out of 10, while three have a level of 7.8 out of 10).
Details about the vulnerabilities are not disclosed, but according to the severity level assigned, they allow access to the host environment from guest systems. Two vulnerabilities only manifest on hosts with Linux, and two only on hosts with Windows. One vulnerability allows remote attacks via HTTP without authentication, but its severity level is rated at 5.9 out of 10 due to the complexity of exploitation.
Key changes in VirtualBox 7.0.16:
- Support for Linux kernel 6.9 has been added in the host and guest system extensions. Support for kernel 6.8 has been added in the guest system extensions (kernel 6.8 was previously supported for hosts).
- In the host and guest system extensions for Linux, the ability to disable automatic loading of the kernel module has been added by setting the parameter mod_name.disabled=1 in the kernel command line.
- In Linux-based host environments, issues with building Linux kernel modules using GCC 13.2 have been resolved.
- In Linux-based host environments, problems with identifying the IPC socket VBoxSVC in the startup script VBox.sh have been resolved, issues that manifest when starting a virtual machine using the sudo utility.
- In the host and guest system extensions for Linux, warnings related to UBSAN support and mk_pte have been addressed.
- In the guest system extensions for Windows, improvements related to graphics have been noted.
- In macOS-based host environments, performance issues have been resolved. of virtual machines when using App Nap.
- The launch of nested guest systems has been simplified using the hypervisor KVM on hosts with Intel CPU.
- Virtual machine crashes occurring on some new AMD CPUs have been eliminated.
- In the USB driver, issues with EHCI controllers have been resolved.
- Support for audio devices has been improved.
- Documentation for the VBoxManage and vboximg-mount utilities has been updated.
- In the Guest Control package, correct Windows session engagement has been established when launching processes in Windows guest environments.
Source: opennet.ru
