Actively exploited · Published Aug 5, 2008 · Assigned by mitre

CVE-2008-3431

High 8.8 Exploited

In plain English

A high-severity security flaw in VirtualBox from Oracle. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 6.9% (higher than 94% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)6.9%top 5.9% of all CVEs

Exploited in the wildYesCISA KEV since Mar 3, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 24, 2022.

Official description

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

30481 vdb-entry, x_refsource_BID
4107 third-party-advisory, x_refsource_SREASON
6218 exploit, x_refsource_EXPLOIT-DB
240095 vendor-advisory, x_refsource_SUNALERT
31361 third-party-advisory, x_refsource_SECUNIA
http://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerability x_refsource_MISC
sun-xvmvirtualbox-privilege-escalation(44202) vdb-entry, x_refsource_XF
ADV-2008-2293 vdb-entry, x_refsource_VUPEN
http://virtualbox.org/wiki/Changelog x_refsource_CONFIRM
1020625 vdb-entry, x_refsource_SECTRACK
20080804 CORE-2008-0716 - Sun xVM VirtualBox Privilege Escalation Vulnerability mailing-list, x_refsource_BUGTRAQ
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-3431 government-resource