CVE-2008-3431
High 8.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Oracle VirtualBox Insufficient Input Validation Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.
Metrics
- CVSS 3.1
-
8.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 7% (percentile: 94) as of 1 November 2026
Affected products
oracle: virtualbox
References
- http://secunia.com/advisories/31361 Broken LinkVendor Advisory
- http://secunia.com/advisories/31361 Broken LinkVendor Advisory
- http://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerabili… ExploitThird Party Advisory
- http://www.securityfocus.com/bid/30481 Broken LinkExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/6218 ExploitThird Party AdvisoryVDB Entry
- http://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerabili… ExploitThird Party Advisory
- http://www.securityfocus.com/bid/30481 Broken LinkExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/6218 ExploitThird Party AdvisoryVDB Entry
- http://securityreason.com/securityalert/4107 Broken Link
- http://securitytracker.com/id?1020625 Broken LinkThird Party AdvisoryVDB Entry