CVE-2008-3431

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
8.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 87%
VendorProductVersion
oraclevirtualbox
𝑥
< 1.6.4
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
virtualbox-ose
hardy
not-affected
gutsy
not-affected
feisty
dne
dapper
dne
References
http://secunia.com/advisories/31361
http://securityreason.com/securityalert/4107
http://securitytracker.com/id?1020625
http://sunsolve.sun.com/search/document.do?assetkey=1-66-240095-1
http://virtualbox.org/wiki/Changelog
http://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerability
http://www.securityfocus.com/archive/1/495095/100/0/threaded
http://www.securityfocus.com/bid/30481
http://www.vupen.com/english/advisories/2008/2293
https://exchange.xforce.ibmcloud.com/vulnerabilities/44202
https://www.exploit-db.com/exploits/6218
http://secunia.com/advisories/31361
http://securityreason.com/securityalert/4107
http://securitytracker.com/id?1020625
http://sunsolve.sun.com/search/document.do?assetkey=1-66-240095-1
http://virtualbox.org/wiki/Changelog
http://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerability
http://www.securityfocus.com/archive/1/495095/100/0/threaded
http://www.securityfocus.com/bid/30481
http://www.vupen.com/english/advisories/2008/2293
https://exchange.xforce.ibmcloud.com/vulnerabilities/44202
https://www.exploit-db.com/exploits/6218