CVE-2019-19048: Missing Release of Memory after Effective Lifetime

A memory leak in the cryptoreportstat function in drivers/virt/vboxguest/vboxguestutils.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service memory consumption by triggering copyformuser failures, aka CID-e0b0cb938864...

CVE-2018-12633

An issue was discovered in the Linux kernel through 4.17.2. vbgmiscdeviceioctl in drivers/virt/vboxguest/vboxguestlinux.c reads the same user data twice with copyfromuser. The header part of the user data is double-fetched, and a malicious user thread can tamper with the critical variables...