CVE-2008-3431

HighActively exploited (CISA KEV)

Description

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

SeverityHigh

CVSS8.8

Exploit probability—

Product

Oracle VirtualBox

PublishedAug 5, 2008

First seenAug 5, 2008

Added to KEVMar 3, 2022

How to fix

CISA required action

Apply updates per vendor instructions.

CISA due date: Mar 24, 2022

Update

oracle virtualbox1.6.4 or later

Affected products

Product	Affected versions	Fixed in
oracle virtualbox	v < 1.6.4	1.6.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.