Description
The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Sun xVM VirtualBox < 1.6.4 - Privilege Escalation (PoC) EDB-6218 · dos · Aug 10, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 30481 vdb-entry
- 4107 third-party-advisory
- 6218 exploit
- 240095 vendor-advisory
- 31361 third-party-advisory
- http://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerability
- sun-xvmvirtualbox-privilege-escalation(44202) vdb-entry
- ADV-2008-2293 vdb-entry
- http://virtualbox.org/wiki/Changelog
- 1020625 vdb-entry
- 20080804 CORE-2008-0716 - Sun xVM VirtualBox Privilege Escalation Vulnerability mailing-list