CVE-2008-3431

Oracle VirtualBox Insufficient Input Validation

8.8 HIGHActively exploited (CISA KEV)Public exploitEPSS 6.88%

Published5 Aug 2008
Added to CISA KEV3 Mar 2022
Remediation due24 Mar 2022

Description

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Oracle Virtualbox< 1.6.4

Remediation

Fixed in

Oracle Virtualbox≥ 1.6.4

Patch & vendor advisories

http://secunia.com/advisories/31361

References

http://secunia.com/advisories/31361Broken LinkVendor Advisory
http://securityreason.com/securityalert/4107Broken Link
http://securitytracker.com/id?1020625Broken LinkThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/44202Third Party AdvisoryVDB Entry
http://sunsolve.sun.com/search/document.do?assetkey=1-66-240095-1Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-3431US Government Resource
https://www.exploit-db.com/exploits/6218ExploitThird Party AdvisoryVDB Entry
http://virtualbox.org/wiki/ChangelogProduct
http://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerabilityExploitThird Party Advisory
http://www.securityfocus.com/archive/1/495095/100/0/threadedBroken LinkThird Party AdvisoryVDB Entry

and 2 more references

Frequently asked

Is CVE-2008-3431 being actively exploited?

Yes. CVE-2008-3431 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Mar 2022.

How severe is CVE-2008-3431?

CVE-2008-3431 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 6.88% probability of exploitation.

Which products are affected by CVE-2008-3431?

Affected products include Oracle Virtualbox.

How do I fix CVE-2008-3431?

Upgrade affected software to a fixed version, for example Oracle Virtualbox 1.6.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2008-3431 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.