CVE-2008-3431

Confirmed PUBLISHED

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and...

Vendor: Sun Product: xVM VirtualBox

Exploited in the wild

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

8.8 High EPSS 6.9%

At a Glance

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

cisa

CVE Published: Aug 05, 2008
Exploitation Reported: Mar 03, 2022
CVSS: 8.8 High
EPSS: 6.9%

Low complexity No user interaction

Affected Versions

Vendor	Product	Version	Status
n/a	n/a	n/a	Affected

CVE References

240095 sunsolve.sun.com · Vendor Advisory http://sunsolve.sun.com/search/document.do?assetkey=1-66-240095-1
4107 securityreason.com · Third-Party Advisory http://securityreason.com/securityalert/4107
31361 secunia.com · Third-Party Advisory http://secunia.com/advisories/31361
6218 exploit-db.com · Exploit https://www.exploit-db.com/exploits/6218
30481 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/30481

Show 6 more references

sun-xvmvirtualbox-privilege-escalation(44202) exchange.xforce.ibmcloud.com · VDB Entry https://exchange.xforce.ibmcloud.com/vulnerabilities/44202
ADV-2008-2293 vupen.com · VDB Entry http://www.vupen.com/english/advisories/2008/2293
1020625 securitytracker.com · VDB Entry http://securitytracker.com/id?1020625
20080804 CORE-2008-0716 - Sun xVM VirtualBox Privilege Escalation Vulnerability securityfocus.com · Mailing List http://www.securityfocus.com/archive/1/495095/100/0/threaded
coresecurity.com/content/virtualbox-privilege-escalation-vuln... coresecurity.com · CVE Record http://www.coresecurity.com/content/virtualbox-privilege-escalation-v...
virtualbox.org/wiki/Changelog virtualbox.org · CVE Record http://virtualbox.org/wiki/Changelog

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2022-03-03 00:00 UTC

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2008-3431

{
  "cve_id": "CVE-2008-3431",
  "title": "The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox befo...",
  "affected_vendor": "Sun",
  "affected_product": "xVM VirtualBox",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 8.8,
  "epss_score": 0.06932,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.