VULNERABILITY INTELLIGENCE
CVE-2008-3431
CVSS score8.8 HIGH
EPSS probability6.88%
CISA KEVKnown exploited vulnerability
Published2008-08-05
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Known Exploited Vulnerability
Oracle VirtualBox Insufficient Input Validation Vulnerability
Vendor / product: Oracle / VirtualBox
Description
The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.
Primary references
- cve@mitre.org — Broken Link, Vendor Advisory
- cve@mitre.org — Broken Link
- cve@mitre.org — Broken Link, Third Party Advisory, VDB Entry
- cve@mitre.org — Broken Link
- cve@mitre.org — Product
- cve@mitre.org — Exploit, Third Party Advisory
- cve@mitre.org — Broken Link, Third Party Advisory, VDB Entry
- cve@mitre.org — Broken Link, Exploit, Third Party Advisory, VDB Entry
- cve@mitre.org — Broken Link
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Vendor Advisory