CVE-2021-25319 virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group

What is CVE-2021-25319?

CVE-2021-25319 is a high-severity vulnerability in openSUSE Factory, published on 5 May 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.

Weakness: CWE-276

Which versions are affected by CVE-2021-25319?

It affects 1 product.

Products include Opensuse Factory.

How do I fix CVE-2021-25319?

Apply the vendor's patch.

Is CVE-2021-25319 being exploited?

There is no known exploitation of CVE-2021-25319 in the wild and no public exploit code.

Other vulnerabilities in openSUSE Factory

• CVE-2022-31256 sendmail: mail to root privilege escalation via sm-client.pre script High 7.7
• CVE-2022-31251 slurm: %post for slurm-testsuite operates as root in user owned directory Medium 6.5
• CVE-2021-36781 parsec: dangerous 777 permissions for /run/parsec Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x9mv-6frm-qg9c, UBUNTU-CVE-2021-25319.