Security Advisory

CVE-2008-3431

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2008-08-05 19:20:00

Last updated 2025-10-22 00:05:55

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

← Browse all CVEs View on cve.org ↗