Vulnerability record

CVE-2008-3431

Oracle VirtualBox Insufficient Input Validation Vulnerability

HighExploitation confirmedCISA KEV

What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run VirtualBox, fix it now.

CISA required action: Apply updates per vendor instructions.

US federal civilian agencies must remediate by Mar 24, 2022.

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.

Description

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

Products affected by this vulnerability, with versions and the source of each entry
Product	Vendor	Affected versions	Fixed in	Source
VirtualBox	Oracle	< 1.6.4	1.6.4	KEV

Sources: KEV = CISA Known Exploited Vulnerabilities catalog.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateKEVSep 30, 2026
CVE-2008-3431 scored CVSS 8.8: Oracle VirtualBox, Oracle VirtualBox Insufficient Input Validation Vulnerability
CISA lists this as exploited in the wild. Unpatched VirtualBox systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References

nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2008-3431
secunia.com http://secunia.com/advisories/31361
securityreason.com http://securityreason.com/securityalert/4107
securitytracker.com http://securitytracker.com/id?1020625
sunsolve.sun.com http://sunsolve.sun.com/search/document.do?assetkey=1-66-240095-1
virtualbox.org http://virtualbox.org/wiki/Changelog
coresecurity.com http://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerability
securityfocus.com http://www.securityfocus.com/archive/1/495095/100/0/threaded
securityfocus.com http://www.securityfocus.com/bid/30481
vupen.com http://www.vupen.com/english/advisories/2008/2293
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/44202
exploit-db.com https://www.exploit-db.com/exploits/6218
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-3431