CVE-2008-3431

HIGH KEV RANSOMWARE

Sun xVM VirtualBox <1.6.4 - Privilege Escalation

Title source: llm

Description

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Core Security · textdosmultiple
https://www.exploit-db.com/exploits/6218

References (12)

Scores

CVSS v3 8.8
EPSS 0.0552
EPSS Percentile 90.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CISA KEV 2022-03-03
VulnCheck KEV 2021-02-11
InTheWild.io 2022-03-03
ENISA EUVD EUVD-2008-3417
Ransomware Use Confirmed
Status published
Products (1)
oracle/virtualbox < 1.6.4
Published Aug 05, 2008
KEV Added Mar 03, 2022
Tracked Since Feb 18, 2026