Description
Unspecified vulnerability in the Oracle VM Virtual Box component in Oracle Virtualization 3.2, 4.0, and 4.1 allows local users to affect availability via unknown vectors related to VirtualBox Core. NOTE: The previous information was obtained from the October 2012 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect interrupt handling."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | virtualbox-ose | 3.2.10-dfsg-1+squeeze1 | DSA-2594-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Oracle VM VirtualBox 4.1 - Local Denial of Service EDB-21224 · dos · Sep 10, 2012
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-2594-1 virtualbox-ose - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- 56045 vdb-entry
- vmvirtualbox-virtualboxcore-dos(79380) vdb-entry
- 1027666 vdb-entry
- oval:org.mitre.oval:def:16681 vdb-entry signature
- http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- DSA-2594 vendor-advisory
- MDVSA-2013:150 vendor-advisory