Oracle VirtualBox Insufficient Input Validation Vulnerability

HOCH 8.8EXPLOITED (CISA KEV)CVE-2008-3431 · Published 05/08/2008 · updated 16/06/2026

Oracle VirtualBox Insufficient Input Validation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/03/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
virtualbox oracle	`< 1.6.4`	`1.6.4`

Description

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

References

secunia.com/advisories/31361 · Broken Link
securityreason.com/securityalert/4107 · Broken Link
securitytracker.com/id · Broken Link
sunsolve.sun.com/search/document.do · Broken Link
virtualbox.org/wiki/Changelog · Product
coresecurity.com/content/virtualbox-privilege-escalation-vulnerability · Exploit
securityfocus.com/archive/1/495095/100/0/threaded · Broken Link
securityfocus.com/bid/30481 · Broken Link
vupen.com/english/advisories/2008/2293 · Broken Link
exchange.xforce.ibmcloud.com/vulnerabilities/44202 · Third Party Advisory
exploit-db.com/exploits/6218 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2008-3431

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free