CVE-2008-3431

HIGH KEV RANSOMWARE

Sun xVM VirtualBox <1.6.4 - Privilege Escalation

Title source: llm

Exploitation Summary

CVE-2008-3431 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 3, 2022, with confirmed use in ransomware campaigns. EIP tracks 1 public exploit from researchers including Core Security.

AI-analyzed exploit summary This exploit demonstrates a privilege escalation vulnerability in Sun xVM VirtualBox's 'VBoxDrv.sys' driver due to insufficient input validation in IOCTL handling. It allows arbitrary kernel memory writes via METHOD_NEITHER, leading to local privilege escalation on Windows hosts.

Description

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Core Security · textdosmultiple

https://www.exploit-db.com/exploits/6218

View Code ZIP pw:eip

This exploit demonstrates a privilege escalation vulnerability in Sun xVM VirtualBox's 'VBoxDrv.sys' driver due to insufficient input validation in IOCTL handling. It allows arbitrary kernel memory writes via METHOD_NEITHER, leading to local privilege escalation on Windows hosts.

Classification

Working Poc 100%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Sun xVM VirtualBox 1.6.2 and 1.6.0 (Windows)

No auth needed

Prerequisites: Local access to a Windows host with vulnerable VirtualBox installed

MITRE ATT&CK