CVE-2008-3431

CVE-2008-3431 is a high-severity (CVSS 8.8) vulnerability in Oracle VirtualBox. CISA added it to the Known Exploited Vulnerabilities catalog on March 3, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 24, 2022. CISA does not currently list it as used in ransomware campaigns. Oracle has 46 vulnerabilities in the KEV catalog, 13 of them linked to ransomware.

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• http://secunia.com/advisories/31361
• http://securityreason.com/securityalert/4107
• http://securitytracker.com/id?1020625
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-240095-1
• http://virtualbox.org/wiki/Changelog
• http://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerability
• http://www.securityfocus.com/archive/1/495095/100/0/threaded
• http://www.securityfocus.com/bid/30481