CVE Intelligence

Oracle Virtualbox vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Oracle Virtualbox: 1 record(s), with affected versions and fixes.
cpe:2.3:a:oracle:virtualbox

CVE-2008-3431 High · 8.8 KEV High · 63 Public exploit Aug 5, 2008
Oracle VirtualBox Insufficient Input Validation Vulnerability
The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.